832538e38de96f15359b7fcfc4a74e5e64a1e6c255a9a4cdd1451ab080c19ca8

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 02:23

Target

BlankGrabberBuilder.exe
Size

7.1MB
MD5

41f73d46b40f8a48fba2da1cbe8ce0e5
SHA1

81792f8f896e965a8c11a7ab4f5e130acd099d2c
SHA256

832538e38de96f15359b7fcfc4a74e5e64a1e6c255a9a4cdd1451ab080c19ca8
SHA512

f52332894c5ca533d109d158822e4af4b0447e84fe99747c2e7b9700692f656d77677598054ec368518ff45a4d3b0384585a9ce815bb375be76a685b7298aede
SSDEEP

196608:KiumWQ4Zv1hhzOjmFwDRxtYSHdK34kdai7bN3m2L+BWT:2zv1hoK2pM9B3Qi4i

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2100	BlankGrabberBuilder.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000018745-22.dat	upx
behavioral1/memory/2100-24-0x000007FEF5E70000-0x000007FEF62D6000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2100	2352	BlankGrabberBuilder.exe	30
PID 2352 wrote to memory of 2100	2352	BlankGrabberBuilder.exe	30
PID 2352 wrote to memory of 2100	2352	BlankGrabberBuilder.exe	30

C:\Users\Admin\AppData\Local\Temp\BlankGrabberBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\BlankGrabberBuilder.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\BlankGrabberBuilder.exe
  "C:\Users\Admin\AppData\Local\Temp\BlankGrabberBuilder.exe"
  2⤵
  - Loads dropped DLL
  PID:2100

C:\Users\Admin\AppData\Local\Temp\_MEI23522\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2100-24-0x000007FEF5E70000-0x000007FEF62D6000-memory.dmp

Filesize
4.4MB

Download