4219dd76634834119f57866c1c0d19fd37cf88d4869d5d98bdc03d69a6422bc7

Analysis

max time kernel
6s
max time network
2s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 18:16

Target

hello253soundspoofer.exe
Size

29.6MB
MD5

7bb14847293c97405c93c2fb0494bf4f
SHA1

15ab2687c7055b63c0de6eb6845d4f4f943a68d1
SHA256

4219dd76634834119f57866c1c0d19fd37cf88d4869d5d98bdc03d69a6422bc7
SHA512

037f839ad58edf904714aabcfe5fea824ff211991b3b8dfd975c572f22ba795e0d967c5487daf361efec2c2996e13586da1b340ff6d58eb694512ef705ec9b16
SSDEEP

786432:WmMlhONW8I8m1NxOpl8dPXB6BYeBL3qW+CxeD6mp3a:WdlhsWt8mxElmPxaYeBzl46W

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2388	hello253soundspoofer.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a38-1155.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2388	2532	hello253soundspoofer.exe	30
PID 2532 wrote to memory of 2388	2532	hello253soundspoofer.exe	30
PID 2532 wrote to memory of 2388	2532	hello253soundspoofer.exe	30

C:\Users\Admin\AppData\Local\Temp\hello253soundspoofer.exe
"C:\Users\Admin\AppData\Local\Temp\hello253soundspoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\hello253soundspoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\hello253soundspoofer.exe"
  2⤵
  - Loads dropped DLL
  PID:2388

C:\Users\Admin\AppData\Local\Temp\_MEI25322\python313.dll

Filesize
1.8MB

MD5
13e0653e90a091bde333f7e652ac6f8b

SHA1
130f3271120487b4aac482af56f4de6673aaaeda

SHA256
a89f9220c5afcb81b9a91f00b3bea9ed21ebd2cbae00785cbc2db264d90c862c

SHA512
ad513df8f9a53cb3a8e5bc430a977c4079e7d7547fce43fe29288988ee458ff2ea922eb979582fe4c276e58cd6ef8d771bf6535170554b82c5d54d87caaf5366

Download Submit
memory/2388-1157-0x000007FEF55D0000-0x000007FEF5C35000-memory.dmp

Filesize
6.4MB

Download