7aebd8303daca5d96c4704b8ec51d829ee0fe09f9e86838ddb6a8b2d29cca291

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 22:38

Target

source_prepared.exe
Size

80.7MB
MD5

2fe639bef473eb64c87216d8b12d3fc0
SHA1

0d0729764a1ce103a61dec0176da662e3e2102fe
SHA256

7aebd8303daca5d96c4704b8ec51d829ee0fe09f9e86838ddb6a8b2d29cca291
SHA512

06928c9af49c5d251d931bf90494b1f0d83355040570a547559b375ad9f7ea225ff911151038ba09cef93bfee7a67e002b61417afe65edb7183ac5212402dde7
SSDEEP

1572864:1GKlgWjCsmwSk8IpG7V+VPhqHJE7Bbli08iYgj+h58sMwgD/ZB:UKi7smwSkB05awHSw025ED

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
876	source_prepared.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020af3-1264.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 876	1488	source_prepared.exe	31
PID 1488 wrote to memory of 876	1488	source_prepared.exe	31
PID 1488 wrote to memory of 876	1488	source_prepared.exe	31

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:876

C:\Users\Admin\AppData\Local\Temp\_MEI14882\python311.dll

Filesize
1.6MB

MD5
87b5d21226d74f069b5ae8fb74743236

SHA1
153651a542db095d0f9088a97351b90d02b307ac

SHA256
3cac88119657daef7f79844aeb9da79b45c1f3bb2ea3468b0d4ed26067852194

SHA512
788bb26b3f4ce99a2b49eef2742972fe843bdd97d361a6e67237f29376648ea6f874f1f6ba6dd53c74ef51a29e650a02fb99dfc30b5badfa9d2e05491f81d7d6

Download Submit
memory/876-1266-0x000007FEF54B0000-0x000007FEF5A98000-memory.dmp

Filesize
5.9MB

Download