78cf8fa783d8333df999da045367299622aeb3a05ba1bf570878cd861ca71cae

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 01:08

Target

source_prepared.exe
Size

80.6MB
MD5

8c182e0e3096a4c3e374048cb93d956d
SHA1

96169cb0243aa8f1c0cf60ea9c675c8fa69f1353
SHA256

78cf8fa783d8333df999da045367299622aeb3a05ba1bf570878cd861ca71cae
SHA512

3d0d5ab61149db6a9bb159159a9e324d25596cffafad4c32151d07b2db37b62e370c22262ce1b8c3068c1cbbe102d536a70ae70d084786f60a10cca619f6a992
SSDEEP

1572864:vGKlgWjDsmwSk8IpG7V+VPhqHJE70bli08iYgj+h58sMwGDuzZET:uKimsmwSkB05awHfw025qiz

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1668	source_prepared.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020abf-1263.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1668	2160	source_prepared.exe	31
PID 2160 wrote to memory of 1668	2160	source_prepared.exe	31
PID 2160 wrote to memory of 1668	2160	source_prepared.exe	31

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:1668

C:\Users\Admin\AppData\Local\Temp\_MEI21602\python311.dll

Filesize
1.6MB

MD5
87b5d21226d74f069b5ae8fb74743236

SHA1
153651a542db095d0f9088a97351b90d02b307ac

SHA256
3cac88119657daef7f79844aeb9da79b45c1f3bb2ea3468b0d4ed26067852194

SHA512
788bb26b3f4ce99a2b49eef2742972fe843bdd97d361a6e67237f29376648ea6f874f1f6ba6dd53c74ef51a29e650a02fb99dfc30b5badfa9d2e05491f81d7d6

Download Submit
memory/1668-1265-0x000007FEF54F0000-0x000007FEF5AD8000-memory.dmp

Filesize
5.9MB

Download