3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 07:18

Target

wsapx.exe
Size

7.5MB
MD5

e302186ae6217d48fc6eef1fe780ec26
SHA1

17fcd5699fc208e8b520eb9ad1c0b4a0305a5f0a
SHA256

3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672
SHA512

29cd7dc1704ba96d71e4cde67fd1d61426dff8c67003121ff4b2c60fd39066f9fe208717f3f1fd78ad991881681b9c9b4c9e790454963caaac3901d2b32313f2
SSDEEP

196608:cdLjv+bhqNVoBLD7fEXEoYbiIv9pvvk9fIiZ1jt:SL+9qz8LD7fEUbiIqQgpt

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2440	wsapx.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019621-21.dat	upx
behavioral1/memory/2440-23-0x000007FEF5840000-0x000007FEF5F10000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2440	2472	wsapx.exe	30
PID 2472 wrote to memory of 2440	2472	wsapx.exe	30
PID 2472 wrote to memory of 2440	2472	wsapx.exe	30

C:\Users\Admin\AppData\Local\Temp\wsapx.exe
"C:\Users\Admin\AppData\Local\Temp\wsapx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\wsapx.exe
  "C:\Users\Admin\AppData\Local\Temp\wsapx.exe"
  2⤵
  - Loads dropped DLL
  PID:2440

C:\Users\Admin\AppData\Local\Temp\_MEI24722\python312.dll

Filesize
1.7MB

MD5
86d9b8b15b0340d6ec235e980c05c3be

SHA1
a03bdd45215a0381dcb3b22408dbc1f564661c73

SHA256
12dbbcd67015d6cdb680752184107b7deb84e906b0e8e860385f85d33858a5f6

SHA512
d360cc3f00d90fd04cbba09d879e2826968df0c1fdc44890c60b8450fe028c3e767450c3543c62d4f284fb7e004a9a33c52538c2279221ee6cbdb1a9485f88b2

Download Submit
memory/2440-23-0x000007FEF5840000-0x000007FEF5F10000-memory.dmp

Filesize
6.8MB

Download