6d4cdd3322df1065d54364dead5a1b6f5d65fea1e7cd2ae5fac4de2877a2a2f3

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 23:22

Target

Built.exe
Size

100.0MB
MD5

104eb0741652d7f2a4a1166cb37dce46
SHA1

eff0c864f476c97df93710ac508ec2289cf32a36
SHA256

6d4cdd3322df1065d54364dead5a1b6f5d65fea1e7cd2ae5fac4de2877a2a2f3
SHA512

85c2c0d6955ee210c38b744bfaadab7034d3b2ced6409e5b4384341679fe44a93b313ddc896aca1eb42fc0c1971175f7d73ab340e3ba794f72253734b2394129
SSDEEP

196608:ikhhOZq5urErvI9pWjg/Qc+4o673pNrabenyzWtPMYnNcsZ:byeurEUWjZZ4dDLIeyzWtPTNzZ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2356	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4b1-21.dat	upx
behavioral1/memory/2356-23-0x000007FEF5420000-0x000007FEF5AE5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2356	2372	Built.exe	31
PID 2372 wrote to memory of 2356	2372	Built.exe	31
PID 2372 wrote to memory of 2356	2372	Built.exe	31

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2356

C:\Users\Admin\AppData\Local\Temp\_MEI23722\python312.dll

Filesize
1.7MB

MD5
eb02b8268d6ea28db0ea71bfe24b15d6

SHA1
86f723fcc4583d7d2bd59ca2749d4b3952cd65a5

SHA256
80222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70

SHA512
693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2

Download Submit
memory/2356-23-0x000007FEF5420000-0x000007FEF5AE5000-memory.dmp

Filesize
6.8MB

Download