11df7be798ab21ac5209c2c8f8c9bdf84a4ddf1f2a539a10c626082ce6b6724c

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-12-2024 21:44

Target

Tiktok V2.1/Launcher.exe
Size

74.0MB
MD5

a222601e469d390b527eaa6d7796a36c
SHA1

a55242603debd8d361072ea91dd7da55495ab9dd
SHA256

b197840d57ce20b1101b0476b599c02b18f2b1ce275af0309819f7ce3f663fc3
SHA512

57570261d6553b5eed9ab3a5fa5808740db1e9e4bf7fb4d6433e325ec85afecdd5e99a51749ef3667cb332d298d76a297b2c7c877a68168ce68939c7835f0e4f
SSDEEP

196608:/IQD+kdnBwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWf:QQ5IIHL7HmBYXrYoaUN4

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2460	Launcher.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001961b-21.dat	upx
behavioral1/memory/2460-23-0x000007FEF5F50000-0x000007FEF65B5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2460	1568	Launcher.exe	31
PID 1568 wrote to memory of 2460	1568	Launcher.exe	31
PID 1568 wrote to memory of 2460	1568	Launcher.exe	31

C:\Users\Admin\AppData\Local\Temp\Tiktok V2.1\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Tiktok V2.1\Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Local\Temp\Tiktok V2.1\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Tiktok V2.1\Launcher.exe"
  2⤵
  - Loads dropped DLL
  PID:2460

C:\Users\Admin\AppData\Local\Temp\_MEI15682\python313.dll

Filesize
1.8MB

MD5
9a3d3ae5745a79d276b05a85aea02549

SHA1
a5e60cac2ca606df4f7646d052a9c0ea813e7636

SHA256
09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889

SHA512
46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69

Download Submit
memory/2460-23-0x000007FEF5F50000-0x000007FEF65B5000-memory.dmp

Filesize
6.4MB

Download
memory/2460-44-0x000007FEF5F50000-0x000007FEF65B5000-memory.dmp

Filesize
6.4MB

Download