7c0ea7aaa73815e7a3e7a459b567024bb418afab7a9e2b638a667e2ae331e282

Analysis

max time kernel
99s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 07:23

Target

PoabGrabber.exe
Size

6.1MB
MD5

735103629b36f00e5e0f2d366eaae44f
SHA1

0c71ea959fcf6f3549ad3d7b9392157f54939bdc
SHA256

7c0ea7aaa73815e7a3e7a459b567024bb418afab7a9e2b638a667e2ae331e282
SHA512

f499e720129abfec0c0c5bec2cdfd0d2aac04e2e2225e1992c330332aaf317b1695903875a184d31e4a45e28d5711b2fa3b5771e7541e9a6ada3728dbfed8192
SSDEEP

196608:W0umWQLVOjmFwDRxtYSHdK34kdai7bN3m2kSvW863:SwwK2pM9B3QtWi3

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2980	PoabGrabber.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019d62-22.dat	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2980	PoabGrabber.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2980	2528	PoabGrabber.exe	30
PID 2528 wrote to memory of 2980	2528	PoabGrabber.exe	30
PID 2528 wrote to memory of 2980	2528	PoabGrabber.exe	30

C:\Users\Admin\AppData\Local\Temp\PoabGrabber.exe
"C:\Users\Admin\AppData\Local\Temp\PoabGrabber.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\PoabGrabber.exe
  "C:\Users\Admin\AppData\Local\Temp\PoabGrabber.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2980

C:\Users\Admin\AppData\Local\Temp\_MEI25282\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2980-24-0x000007FEF66B0000-0x000007FEF6B16000-memory.dmp

Filesize
4.4MB

Download
memory/2980-25-0x000007FEF66B0000-0x000007FEF6B16000-memory.dmp

Filesize
4.4MB

Download