3aa6ab768e83c7c2e638c8ebe26be86c49a85b7f7445fc0e0948ef44db7ae812

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23/12/2024, 19:32

Target

AphroditeTweakingUtility.exe
Size

8.6MB
MD5

b5036c5763c816a3f39153a288f375e1
SHA1

47bd6d3eb43d0ec19ff80b56bd41314becc5347f
SHA256

3aa6ab768e83c7c2e638c8ebe26be86c49a85b7f7445fc0e0948ef44db7ae812
SHA512

00bc737089b0eeaf7ac5b2a1f7265e230f49009d241b8f597913b020a1a1197818e11707e19871f5099a3c6defd738fb92d10038f6a05b9b1181bc108537c479
SSDEEP

196608:Bg8PRLrVdfsjLjv+bhqNVoB0SEsucQZ41JBbIEs1Lp:28PLKL+9qz80SJHQK1J9shp

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2912	AphroditeTweakingUtility.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019d62-22.dat	upx
behavioral1/memory/2912-24-0x000007FEF6200000-0x000007FEF67EE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2912	2660	AphroditeTweakingUtility.exe	29
PID 2660 wrote to memory of 2912	2660	AphroditeTweakingUtility.exe	29
PID 2660 wrote to memory of 2912	2660	AphroditeTweakingUtility.exe	29

C:\Users\Admin\AppData\Local\Temp\AphroditeTweakingUtility.exe
"C:\Users\Admin\AppData\Local\Temp\AphroditeTweakingUtility.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\AphroditeTweakingUtility.exe
  "C:\Users\Admin\AppData\Local\Temp\AphroditeTweakingUtility.exe"
  2⤵
  - Loads dropped DLL
  PID:2912

C:\Users\Admin\AppData\Local\Temp\_MEI26602\python311.dll

Filesize
1.6MB

MD5
76eb1ad615ba6600ce747bf1acde6679

SHA1
d3e1318077217372653be3947635b93df68156a4

SHA256
30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

SHA512
2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

Download Submit
memory/2912-24-0x000007FEF6200000-0x000007FEF67EE000-memory.dmp

Filesize
5.9MB

Download