4ad426172639516e2dd5e98c32f670db5457065c05f8ab87269459eebb057552

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18/12/2024, 02:34

Target

yedek-main/WindowsUpdateAgent.exe
Size

7.4MB
MD5

7d4b7c9479e46227120720f2a2dcccda
SHA1

a85ad8695c5f1703ab6b1abd07eff86b4da4adca
SHA256

94525a0b12c1be31a958bb137d9c1a6f35cef4e9b0c01f95b75981bae5518d93
SHA512

c0cb31863256206f4c0e39d3baa8d5869e2cab630b3f9e1453d45964b054ca85ff11c5cf17c157efe84d16dc1f413f27cb762dfa1a0ab8f2a4556d901faa3c07
SSDEEP

196608:xmlEzPoLjv+bhqNVoB8Ck5c7GpNlpq41J2Jbk9qtlDf6s0:ChL+9qz88Ck+7q3p91JBqfJ0

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3000	WindowsUpdateAgent.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/files/0x0005000000019820-21.dat	upx
behavioral5/memory/3000-23-0x000007FEF5D80000-0x000007FEF6458000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3000	2164	WindowsUpdateAgent.exe	29
PID 2164 wrote to memory of 3000	2164	WindowsUpdateAgent.exe	29
PID 2164 wrote to memory of 3000	2164	WindowsUpdateAgent.exe	29

C:\Users\Admin\AppData\Local\Temp\yedek-main\WindowsUpdateAgent.exe
"C:\Users\Admin\AppData\Local\Temp\yedek-main\WindowsUpdateAgent.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\yedek-main\WindowsUpdateAgent.exe
  "C:\Users\Admin\AppData\Local\Temp\yedek-main\WindowsUpdateAgent.exe"
  2⤵
  - Loads dropped DLL
  PID:3000

C:\Users\Admin\AppData\Local\Temp\_MEI21642\python312.dll

Filesize
1.8MB

MD5
2f1072ddd9a88629205e7434ed055b3e

SHA1
20da3188dabe3d5fa33b46bfe671e713e6fa3056

SHA256
d086257a6b36047f35202266c8eb8c1225163bd96b064d31b80f0dbe13da2acf

SHA512
d8dddc30733811ed9a9c4ae83ac8f3fc4d8ba3fa8051d95242fbd432fd5bf24122373ac5eea9fec78f0daf7c1133365f519a13cf3f105636da74820a00a25e9b

Download Submit
memory/3000-23-0x000007FEF5D80000-0x000007FEF6458000-memory.dmp

Filesize
6.8MB

Download