d28f3d7afe5e864574d8af35be454d8ada064af16f1b9f03a89f4139aeee84a1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 19:24

Target

LatinsOptimizer.exe
Size

8.2MB
MD5

b0643736c22660561c51ecaa27998aca
SHA1

cb0795313488b34679e4e64ddebff5be5ac6c5e4
SHA256

d28f3d7afe5e864574d8af35be454d8ada064af16f1b9f03a89f4139aeee84a1
SHA512

6f72520ea88fe3708434b5085a34d561a41d8ddfee779d3c15827b9ac1ed034d6fedf53e24a752a8bf5caed71053ca11857ca54c9a1f95276cb588a4c736b858
SSDEEP

196608:Rg8PlQvELjv+bhqNVoB0SEsucQZ41JBbIEs1Lv:28PlQ8L+9qz80SJHQK1J9shv

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2128	LatinsOptimizer.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001936b-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2128	1708	LatinsOptimizer.exe	31
PID 1708 wrote to memory of 2128	1708	LatinsOptimizer.exe	31
PID 1708 wrote to memory of 2128	1708	LatinsOptimizer.exe	31

C:\Users\Admin\AppData\Local\Temp\LatinsOptimizer.exe
"C:\Users\Admin\AppData\Local\Temp\LatinsOptimizer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\LatinsOptimizer.exe
  "C:\Users\Admin\AppData\Local\Temp\LatinsOptimizer.exe"
  2⤵
  - Loads dropped DLL
  PID:2128

C:\Users\Admin\AppData\Local\Temp\_MEI17082\python311.dll

Filesize
1.6MB

MD5
76eb1ad615ba6600ce747bf1acde6679

SHA1
d3e1318077217372653be3947635b93df68156a4

SHA256
30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

SHA512
2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

Download Submit
memory/2128-24-0x000007FEF6230000-0x000007FEF681E000-memory.dmp

Filesize
5.9MB

Download