ae0dc20b4d9ec8d0ceb4727295f2012972d40cf98bc18ef32a2a8472b7ead1c9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-12-2024 04:26

Target

toll.exe
Size

5.9MB
MD5

690c1d163b35c2ca9989403127c5d500
SHA1

3954611bdfe65457117ff542cc2125dc904ef113
SHA256

a2b568fbc6537cb9f18c090a092ca1cecc2e96a635ef8c7ac6c3ff1ff755acba
SHA512

5afb5c471de18054cdd34fc253a5400805e480906fb75b005e6e1a702badbeb16c1401f2683efe2afbb9a1fc00a8277f2c81a72090c32e5042cba64fbdc14e62
SSDEEP

98304:F2+nh2M0i65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFK9hJkrF/6Vi:F9nGDOYjJlpZstQoS9Hf12VKXlbJCAVA

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2772	toll.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001929a-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2772	2512	toll.exe	31
PID 2512 wrote to memory of 2772	2512	toll.exe	31
PID 2512 wrote to memory of 2772	2512	toll.exe	31

C:\Users\Admin\AppData\Local\Temp\toll.exe
"C:\Users\Admin\AppData\Local\Temp\toll.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\toll.exe
  "C:\Users\Admin\AppData\Local\Temp\toll.exe"
  2⤵
  - Loads dropped DLL
  PID:2772

C:\Users\Admin\AppData\Local\Temp\_MEI25122\python310.dll

Filesize
1.4MB

MD5
b93eda8cc111a5bde906505224b717c3

SHA1
5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e

SHA256
efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983

SHA512
b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

Download Submit
memory/2772-23-0x000007FEF5DF0000-0x000007FEF6255000-memory.dmp

Filesize
4.4MB

Download