decb0b47bdccfb1c283b566a8c5d657c0dcbf9767ef26eb28aaeefb3d0d2e554

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 21:01

Target

superdoopercoolthking.exe
Size

80.6MB
MD5

9bb8279fe0e91d92d1c556265259877b
SHA1

aa6546ba10662a575dd2efe6f35776dd401d2dcb
SHA256

decb0b47bdccfb1c283b566a8c5d657c0dcbf9767ef26eb28aaeefb3d0d2e554
SHA512

37b903a3d6488f472a3ec9972cd5fe0d9e39ad1dc89d05740525da54b6a5ac030be6fc3bdd39d07d2766c29cd5f90783569657c1f614e3e4c993e68ab62b161e
SSDEEP

1572864:eGKlgWjosmwSk8IpG7V+VPhqHJE70bli08iYgj+h58sMwUD/ZeT:PKiVsmwSkB05awHfw025YD

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1992	superdoopercoolthking.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00030000000209f3-1263.dat	upx
behavioral1/memory/1992-1265-0x000007FEF5470000-0x000007FEF5A58000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1992	2200	superdoopercoolthking.exe	30
PID 2200 wrote to memory of 1992	2200	superdoopercoolthking.exe	30
PID 2200 wrote to memory of 1992	2200	superdoopercoolthking.exe	30

C:\Users\Admin\AppData\Local\Temp\superdoopercoolthking.exe
"C:\Users\Admin\AppData\Local\Temp\superdoopercoolthking.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\superdoopercoolthking.exe
  "C:\Users\Admin\AppData\Local\Temp\superdoopercoolthking.exe"
  2⤵
  - Loads dropped DLL
  PID:1992

C:\Users\Admin\AppData\Local\Temp\_MEI22002\python311.dll

Filesize
1.6MB

MD5
87b5d21226d74f069b5ae8fb74743236

SHA1
153651a542db095d0f9088a97351b90d02b307ac

SHA256
3cac88119657daef7f79844aeb9da79b45c1f3bb2ea3468b0d4ed26067852194

SHA512
788bb26b3f4ce99a2b49eef2742972fe843bdd97d361a6e67237f29376648ea6f874f1f6ba6dd53c74ef51a29e650a02fb99dfc30b5badfa9d2e05491f81d7d6

Download Submit
memory/1992-1265-0x000007FEF5470000-0x000007FEF5A58000-memory.dmp

Filesize
5.9MB

Download