ea63c1b79503aeca26e1666eabd3ffd6f852f3e4d1b436d1fa7b592b18d4eb44

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-12-2024 17:02

Target

CatPublicFr (2).exe
Size

12.9MB
MD5

741e25e8d170e8d4a1983f8945756f22
SHA1

c35153f7fb0888598f65d438b270fe837cdc9fe8
SHA256

ea63c1b79503aeca26e1666eabd3ffd6f852f3e4d1b436d1fa7b592b18d4eb44
SHA512

d1761e6861728b03c15236de0d15c527d9b87276d15134cc9d5d11a89a29d045a596126c7d32373c225cdceba9e7701b5286e44f12a0d0a65402a9f52bbee606
SSDEEP

393216:u6Px4ae4PT1Qmrmykx4APurEUWjZZ4dDLIeyzWtPTNzx:dx4aBhQb7GYdbZZ6geNNF

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2896	CatPublicFr (2).exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019244-22.dat	upx
behavioral1/memory/2896-24-0x000007FEF5E80000-0x000007FEF6545000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2896	1928	CatPublicFr (2).exe	31
PID 1928 wrote to memory of 2896	1928	CatPublicFr (2).exe	31
PID 1928 wrote to memory of 2896	1928	CatPublicFr (2).exe	31

C:\Users\Admin\AppData\Local\Temp\CatPublicFr (2).exe
"C:\Users\Admin\AppData\Local\Temp\CatPublicFr (2).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\CatPublicFr (2).exe
  "C:\Users\Admin\AppData\Local\Temp\CatPublicFr (2).exe"
  2⤵
  - Loads dropped DLL
  PID:2896

C:\Users\Admin\AppData\Local\Temp\_MEI19282\python312.dll

Filesize
1.7MB

MD5
eb02b8268d6ea28db0ea71bfe24b15d6

SHA1
86f723fcc4583d7d2bd59ca2749d4b3952cd65a5

SHA256
80222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70

SHA512
693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2

Download Submit
memory/2896-24-0x000007FEF5E80000-0x000007FEF6545000-memory.dmp

Filesize
6.8MB

Download