0ac72c96a93a7847318681d72a9ecc40c420c58cefef2e18d307d1c233a8ab3c

Resubmissions

21-12-2024 00:43

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 00:43

Target

report.exe
Size

16.5MB
MD5

0348ea94a168413a893e608d75612afd
SHA1

dce50e3c0eb33c43a668212e2684294ac1097ef8
SHA256

0ac72c96a93a7847318681d72a9ecc40c420c58cefef2e18d307d1c233a8ab3c
SHA512

22e370a17b6bc7e39bfbab474e0e8805bb416c637e123f2c4f1858028c6226e0ac14a905243851685ea079f5e438cd5ca104c884aa457eee4a4ad8f4c845aa10
SSDEEP

393216:vVVE3cSGzhFYP3CudbnJPzErcfAIH2gYBgDWJTnz6:vjE3+z697PQrcfwBB+Wl6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2724	report.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001957e-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2724	2384	report.exe	31
PID 2384 wrote to memory of 2724	2384	report.exe	31
PID 2384 wrote to memory of 2724	2384	report.exe	31

C:\Users\Admin\AppData\Local\Temp\report.exe
"C:\Users\Admin\AppData\Local\Temp\report.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\report.exe
  "C:\Users\Admin\AppData\Local\Temp\report.exe"
  2⤵
  - Loads dropped DLL
  PID:2724

C:\Users\Admin\AppData\Local\Temp\_MEI23842\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2724-24-0x000007FEF62B0000-0x000007FEF6975000-memory.dmp

Filesize
6.8MB

Download