a458d5b82d6dc62ac7ad4e8306718bf745bfacf974a93e5c124f2d158176f45f

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 05:35

Target

zen.exe
Size

31.4MB
MD5

f27d16dab34aef4b806febdc586bbd75
SHA1

cf57fd534771deba3ad1fbd7699bc21850442ae3
SHA256

a458d5b82d6dc62ac7ad4e8306718bf745bfacf974a93e5c124f2d158176f45f
SHA512

71181109119ea79844cc3961bf459473134d7d3442e0e098a52d59c529ff6a96b77380f76437eb72cf848a5f29b8748fb9e9c121bfb3b8531bfaf91bf21fc2c8
SSDEEP

786432:i9Z9HcEbh7vDkdbZzcY876t9e7K8vCW8zlXIijPtImZ16cEE5IyLII:0vHcEbh7vQdRE7oEudW49j6uZoH

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2376	zen.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001cc8f-1114.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2376	2420	zen.exe	31
PID 2420 wrote to memory of 2376	2420	zen.exe	31
PID 2420 wrote to memory of 2376	2420	zen.exe	31

C:\Users\Admin\AppData\Local\Temp\zen.exe
"C:\Users\Admin\AppData\Local\Temp\zen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\zen.exe
  "C:\Users\Admin\AppData\Local\Temp\zen.exe"
  2⤵
  - Loads dropped DLL
  PID:2376

C:\Users\Admin\AppData\Local\Temp\_MEI24202\python312.dll

Filesize
1.7MB

MD5
506c760a20e6bb940590229d41449ffa

SHA1
b7c439f253987fb0ff66fc5ce959cf711b18eb8d

SHA256
e63503b2715df3eab8abb9b2682129e27a7add9acea9008f06f55494a2b2f3d5

SHA512
34df2e8e53caac0cd72cb3c5848296ca8cfa10c542c0a5f88385d6b35ab70b86957540de2ff105a27cefb37ccbb5789261a69132b535a857df32875c1f9deb9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24202\wheel-0.43.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
memory/2376-1116-0x000007FEF6630000-0x000007FEF6CF4000-memory.dmp

Filesize
6.8MB

Download