f7ad006e81d31cee24da86d57118115c219f4aed36d1dab610f51aa29d13eb0c

Resubmissions

30-12-2024 00:13

28-12-2024 03:22

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-12-2024 03:22

Target

Blubbyfatfish.exe
Size

29.6MB
MD5

16cbbedef1a05451c445b3ce2f438b56
SHA1

5d63e897a5353aabc4109fadfc4a7a6a7d68ec2a
SHA256

f7ad006e81d31cee24da86d57118115c219f4aed36d1dab610f51aa29d13eb0c
SHA512

6142ec3615a986d68894f07c3969f6de957b34dc2f9f59ba6c81f839838b1ba81eeaea68b57ecf4062468d207afb4b80c05fe88ed884b155079e785f1e15d56c
SSDEEP

786432:kmMlhONW87i8m1NxOcl8dPXB6BYeBLldg+CxeD6mV3a:kdlhsWR8mxBlmPxaYeBBa462

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2536	Blubbyfatfish.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a49-1155.dat	upx
behavioral1/memory/2536-1157-0x000007FEF60D0000-0x000007FEF6735000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2536	2812	Blubbyfatfish.exe	29
PID 2812 wrote to memory of 2536	2812	Blubbyfatfish.exe	29
PID 2812 wrote to memory of 2536	2812	Blubbyfatfish.exe	29

C:\Users\Admin\AppData\Local\Temp\Blubbyfatfish.exe
"C:\Users\Admin\AppData\Local\Temp\Blubbyfatfish.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Temp\Blubbyfatfish.exe
  "C:\Users\Admin\AppData\Local\Temp\Blubbyfatfish.exe"
  2⤵
  - Loads dropped DLL
  PID:2536

C:\Users\Admin\AppData\Local\Temp\_MEI28122\python313.dll

Filesize
1.8MB

MD5
13e0653e90a091bde333f7e652ac6f8b

SHA1
130f3271120487b4aac482af56f4de6673aaaeda

SHA256
a89f9220c5afcb81b9a91f00b3bea9ed21ebd2cbae00785cbc2db264d90c862c

SHA512
ad513df8f9a53cb3a8e5bc430a977c4079e7d7547fce43fe29288988ee458ff2ea922eb979582fe4c276e58cd6ef8d771bf6535170554b82c5d54d87caaf5366

Download Submit
memory/2536-1157-0x000007FEF60D0000-0x000007FEF6735000-memory.dmp

Filesize
6.4MB

Download