1a50b823f71c6b2d20ef8114aeafb5c2e426121d8fb3fed78c1de8b3a53ef497

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 12:18

Target

matrix/newuimatrix.exe
Size

7.6MB
MD5

f4f26680c7aed442b3a8e99e2b3c4190
SHA1

dd22f527c0d90f971e4365ea403f3bdaeef035c3
SHA256

85b04c1a686fc8a8a55bdaa043e20cd42ed775cf8ba6039346721324b83f409f
SHA512

8b42f71571a93d95cfe12ffae40e3226e219f10b82a1d5c195073c6ba8880c5781f92ffddabf601c6c5c4df12b1c5e2066db07c12a47631ee1a9926efa784ee5
SSDEEP

196608:RrD+kdlPwfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWl:t5wIHL7HmBYXrYSaUNv

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3028	newuimatrix.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001967f-21.dat	upx
behavioral1/memory/3028-23-0x000007FEF6360000-0x000007FEF69C5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3028	2100	newuimatrix.exe	30
PID 2100 wrote to memory of 3028	2100	newuimatrix.exe	30
PID 2100 wrote to memory of 3028	2100	newuimatrix.exe	30

C:\Users\Admin\AppData\Local\Temp\matrix\newuimatrix.exe
"C:\Users\Admin\AppData\Local\Temp\matrix\newuimatrix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\matrix\newuimatrix.exe
  "C:\Users\Admin\AppData\Local\Temp\matrix\newuimatrix.exe"
  2⤵
  - Loads dropped DLL
  PID:3028

C:\Users\Admin\AppData\Local\Temp\_MEI21002\python313.dll

Filesize
1.8MB

MD5
9a3d3ae5745a79d276b05a85aea02549

SHA1
a5e60cac2ca606df4f7646d052a9c0ea813e7636

SHA256
09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889

SHA512
46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69

Download Submit
memory/3028-23-0x000007FEF6360000-0x000007FEF69C5000-memory.dmp

Filesize
6.4MB

Download