0f60fb03dc45218372b8e0d174534e8295a8ded3894069162ba1c581a233eb05

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 19:11

Target

RATcontrolpanel.exe
Size

81.2MB
MD5

45dfbeb921c2ba334d5c2345974f5e37
SHA1

1878b30e4a2e1e8bfa1c996ba7aef3aa740c90b8
SHA256

0f60fb03dc45218372b8e0d174534e8295a8ded3894069162ba1c581a233eb05
SHA512

f57f0137a0b34837756dda6d0d487280ab54477a0ff66eeb404b54f5c18112b181dd52cc997a737d056bcbb8af263cc99205081dfe423086f88b33ffc93724ea
SSDEEP

1572864:1GKlXebW8smwSk8IpG7V+VPhqb+T9E7NliHiYgj+h58sMw5IRerWhH/cJFJ:UKRCbsmwSkB05awb+TwwZ5Foer4eJ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2720	RATcontrolpanel.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020b1a-1264.dat	upx
behavioral1/memory/2720-1266-0x000007FEF6400000-0x000007FEF69E9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2720	2348	RATcontrolpanel.exe	29
PID 2348 wrote to memory of 2720	2348	RATcontrolpanel.exe	29
PID 2348 wrote to memory of 2720	2348	RATcontrolpanel.exe	29

C:\Users\Admin\AppData\Local\Temp\RATcontrolpanel.exe
"C:\Users\Admin\AppData\Local\Temp\RATcontrolpanel.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\RATcontrolpanel.exe
  "C:\Users\Admin\AppData\Local\Temp\RATcontrolpanel.exe"
  2⤵
  - Loads dropped DLL
  PID:2720

C:\Users\Admin\AppData\Local\Temp\_MEI23482\python311.dll

Filesize
1.6MB

MD5
8ea69ca2292c3af9cdb46dded91bc837

SHA1
72de7df68b2c336720d1528c34f21ff00ed7a2ce

SHA256
3512c3a7ad74af034f51eba397c0e4716f592861ea3030745e8fd4dc8f9bca49

SHA512
fb317bab11c922dc183d834b770e37e382b9cf3ab1ea95e9bca8d73ed1e23cc9ef2b6aea4a20d4637eba34276c81a6eee54b00cb146f825ef554d81387ae4ddc

Download Submit
memory/2720-1266-0x000007FEF6400000-0x000007FEF69E9000-memory.dmp

Filesize
5.9MB

Download