14b4bd22b738c56d5ab203784d78508126fb5c49e6aa4393fb12064c07ac0fda

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 19:46

Target

source_prepared.exe
Size

76.6MB
MD5

8a1f17a40b9a9d450f8242fe79bbd834
SHA1

cf71c8967403f1d23de32d3a0364f5f3fc2028b0
SHA256

14b4bd22b738c56d5ab203784d78508126fb5c49e6aa4393fb12064c07ac0fda
SHA512

bdcd870813a7458e8dbe475bc7bbf66beb4bfedc9a3f88ee380e46affce71c0d6aa8bdee09a91679aa14428a2bee1e5375665170908bea6082f226d2e3aadaea
SSDEEP

1572864:X1l92W0mUSk8IpG7V+VPhqb+TUE7Tlhe7fEYiYweyJulZUdgRI6XPkfxmDtaJS:X1KPmUSkB05awb+TVLPhpulvXjtao

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3016	source_prepared.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020aa9-1267.dat	upx
behavioral1/memory/3016-1269-0x000007FEF5E20000-0x000007FEF64F0000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3016	2340	source_prepared.exe	30
PID 2340 wrote to memory of 3016	2340	source_prepared.exe	30
PID 2340 wrote to memory of 3016	2340	source_prepared.exe	30

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:3016

C:\Users\Admin\AppData\Local\Temp\_MEI23402\python312.dll

Filesize
1.7MB

MD5
f23aa992b8e0a301ec8f473d6b784f4b

SHA1
ee73a5da238341cb21a781a3ddcb187d1f971680

SHA256
0ddfba7779ebc44f2fa819a78b54bc730a5543274986e973beee024fab0ecfc6

SHA512
028abb66298fee6173d34f80940f5bdd3988a8373234f32a780ae93e155d90af191d85164077d9b76dc3651bda4d9902ccbfd03d37be3e9662006b65c3defb35

Download Submit
memory/3016-1269-0x000007FEF5E20000-0x000007FEF64F0000-memory.dmp

Filesize
6.8MB

Download