ae5c57ff6ae53782f3767e0fcffcafb0368af0530c8197cd0fcaab1ffda98859

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 02:45

Target

ItroublveTSC.exe
Size

7.6MB
MD5

d3ef02070bfa081974b1c1d3d479d1af
SHA1

371913c4493df24aff9dd5511445d5a6d8c3e79c
SHA256

ae5c57ff6ae53782f3767e0fcffcafb0368af0530c8197cd0fcaab1ffda98859
SHA512

601c97e5fafd8a4ce57b8bc0301bec60d927c0b8ba1366e42a3bd6e0830f9c6448506df7586943b0c4f8763e67620ab6d5ec3967e61ba8bde43348aa004f5872
SSDEEP

98304:MUvsBAgasrYqwRhI3l72Qj1qCVgWBg+uoQs+YX5dfXHzjNZnXscacRX1t9XMGh8j:MMgIqwfI9jUC2gYBYv3vbW+DcGiwwnL

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2700	ItroublveTSC.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000193df-21.dat	upx
behavioral1/memory/2700-23-0x000007FEF59F0000-0x000007FEF60B5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2700	2568	ItroublveTSC.exe	30
PID 2568 wrote to memory of 2700	2568	ItroublveTSC.exe	30
PID 2568 wrote to memory of 2700	2568	ItroublveTSC.exe	30

C:\Users\Admin\AppData\Local\Temp\ItroublveTSC.exe
"C:\Users\Admin\AppData\Local\Temp\ItroublveTSC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\ItroublveTSC.exe
  "C:\Users\Admin\AppData\Local\Temp\ItroublveTSC.exe"
  2⤵
  - Loads dropped DLL
  PID:2700

C:\Users\Admin\AppData\Local\Temp\_MEI25682\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2700-23-0x000007FEF59F0000-0x000007FEF60B5000-memory.dmp

Filesize
6.8MB

Download