7cd7eaa612e73ff5601437663af2f960776a1a60be7d7236d938f28b127f90b3

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 03:18

Target

jews.exe
Size

76.8MB
MD5

300e21fecc8fb2caf8cbdfca73a88efe
SHA1

edd52977000151debf4d7fc0e23fffa9b314d9e0
SHA256

7cd7eaa612e73ff5601437663af2f960776a1a60be7d7236d938f28b127f90b3
SHA512

9756f0590cf0f85d00afa68f9915401380ab092f9b5009efe18801919915f9cd2d49786832826a54355c1841945d163acb4ab669e085e22d98f1aaadb368473d
SSDEEP

1572864:i1loWMHmUSk8IpG7V+VPhqQdSTE7xFlhqXiYweyJulZUdg33XiRybL/Z9Ui:i1O7mUSkB05awkSyLPpuT3vh9U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3048	jews.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a72-1268.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3048	3000	jews.exe	30
PID 3000 wrote to memory of 3048	3000	jews.exe	30
PID 3000 wrote to memory of 3048	3000	jews.exe	30

C:\Users\Admin\AppData\Local\Temp\jews.exe
"C:\Users\Admin\AppData\Local\Temp\jews.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\jews.exe
  "C:\Users\Admin\AppData\Local\Temp\jews.exe"
  2⤵
  - Loads dropped DLL
  PID:3048

C:\Users\Admin\AppData\Local\Temp\_MEI30002\python312.dll

Filesize
1.7MB

MD5
18677d48ba556e529b73d6e60afaf812

SHA1
68f93ed1e3425432ac639a8f0911c144f1d4c986

SHA256
8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

SHA512
a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

Download Submit
memory/3048-1270-0x000007FEF6350000-0x000007FEF6A14000-memory.dmp

Filesize
6.8MB

Download