424e22d4538725b422d138cd63d353af0cf18d4985cdda14c0b5938b0c433fda

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 19:33

Target

dox neyroxx2.o.exe
Size

7.5MB
MD5

238dfb90821736dd15f98a25ea59e439
SHA1

3b24726cb7a4e0723b9dcbd375e3e5f3c240dfd0
SHA256

424e22d4538725b422d138cd63d353af0cf18d4985cdda14c0b5938b0c433fda
SHA512

88b756eb05f4212a79dad390f9af78322956e562a1c797d571d69532cdefd7f67424d45e545da78545cb76d2fa7b7be67822efbc38d7270757aaf061ec998023
SSDEEP

196608:L91dO6h6wfI9jUCnORird1KfbLOYgN2oc+nBIdAxW:Zq6XIHOQ76bynnBIf

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2712	dox neyroxx2.o.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019441-21.dat	upx
behavioral1/memory/2712-23-0x000007FEF5E50000-0x000007FEF6511000-memory.dmp	upx

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2712	dox neyroxx2.o.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2712	2224	dox neyroxx2.o.exe	30
PID 2224 wrote to memory of 2712	2224	dox neyroxx2.o.exe	30
PID 2224 wrote to memory of 2712	2224	dox neyroxx2.o.exe	30

C:\Users\Admin\AppData\Local\Temp\dox neyroxx2.o.exe
"C:\Users\Admin\AppData\Local\Temp\dox neyroxx2.o.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\dox neyroxx2.o.exe
  "C:\Users\Admin\AppData\Local\Temp\dox neyroxx2.o.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:2712

C:\Users\Admin\AppData\Local\Temp\_MEI22242\python312.dll

Filesize
1.7MB

MD5
3c5c6c489c358149c970b3b2e562be5f

SHA1
2f1077db20405b0a176597ed34a10b4730af3ca9

SHA256
73a22a12ea3d7f763ed2cea94bb877441f4134b40f043c400648d85565757741

SHA512
d3fb4e5df409bf2de4f5dc5d02d806aee649a21c339c648248b835c3d5d66ab88312c076c149eaadaa3ce0fb43e6fa293bfa369d8876d6eb18742bd9d12448e3

Download Submit
memory/2712-23-0x000007FEF5E50000-0x000007FEF6511000-memory.dmp

Filesize
6.8MB

Download
memory/2712-24-0x000007FEF5E50000-0x000007FEF6511000-memory.dmp

Filesize
6.8MB

Download