d716ea3a153302a94113da989bb30886eed6fb48ae80d851dbdfe2ed4161a2d2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 00:50

Target

corrupt perm.exe
Size

5.9MB
MD5

e353a269346c7d04f4fe57b2d7b56691
SHA1

75cee47332191ae6b4efae532898ed9b03f3f8f2
SHA256

d716ea3a153302a94113da989bb30886eed6fb48ae80d851dbdfe2ed4161a2d2
SHA512

34f54157ae617ec4bec534ba646af88eadf71b956e70fa36b5c10cd0d5726656e91a39e3e41e90440b9112f029e9a7d3f99ecd7f08c4880a7c034119eb52a17f
SSDEEP

98304:dvmoDUN43Wlmd+jOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aTtMFy:dvumWo8OjmFwDRxtYSHdK34kdai7bN3Q

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2904	corrupt perm.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019214-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2904	2252	corrupt perm.exe	30
PID 2252 wrote to memory of 2904	2252	corrupt perm.exe	30
PID 2252 wrote to memory of 2904	2252	corrupt perm.exe	30

C:\Users\Admin\AppData\Local\Temp\corrupt perm.exe
"C:\Users\Admin\AppData\Local\Temp\corrupt perm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\corrupt perm.exe
  "C:\Users\Admin\AppData\Local\Temp\corrupt perm.exe"
  2⤵
  - Loads dropped DLL
  PID:2904

C:\Users\Admin\AppData\Local\Temp\_MEI22522\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2904-24-0x000007FEF58D0000-0x000007FEF5D36000-memory.dmp

Filesize
4.4MB

Download