49d49e515fe1b2d29deb4667622420aea2e4a3c2f04babae14cce0b7732f5f5b

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 17:55

Target

cwel.exe
Size

76.6MB
MD5

af68905bc16868fab729dcee959cc0b1
SHA1

26bbeb56c4c6f8e0b73c57eac00dc04123cf9cb7
SHA256

49d49e515fe1b2d29deb4667622420aea2e4a3c2f04babae14cce0b7732f5f5b
SHA512

17b7922eb3f60c27978f3cee16202ffe1ca29da351e53399b03b225d0afb9286c954d970ee4399b68ae8f220336783247d62978d69fd54664ab6e7360487cf6f
SSDEEP

1572864:r1l7Wd5mUSk8IpG7V+VPhqFxE7glhWiYweyJulZUdg6zfqiuWd72:r1Z05mUSkB05awF1LLpuqiOZ2

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1956	cwel.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a80-1271.dat	upx
behavioral1/memory/1956-1273-0x000007FEF60F0000-0x000007FEF67B1000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1956	2404	cwel.exe	31
PID 2404 wrote to memory of 1956	2404	cwel.exe	31
PID 2404 wrote to memory of 1956	2404	cwel.exe	31

C:\Users\Admin\AppData\Local\Temp\cwel.exe
"C:\Users\Admin\AppData\Local\Temp\cwel.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\cwel.exe
  "C:\Users\Admin\AppData\Local\Temp\cwel.exe"
  2⤵
  - Loads dropped DLL
  PID:1956

C:\Users\Admin\AppData\Local\Temp\_MEI24042\python312.dll

Filesize
1.7MB

MD5
ebd1e51a1a1c1534f1695bc71beecbe0

SHA1
280b29f98df389d5f239fc54d71b258b07a5d290

SHA256
3ac7db2567f747a6a16447bc559a6aa20ba846ff9a6fdaf25f2b301a95889b90

SHA512
2db7e56fb166ea95cadfd3eec13a003727b33dc56e07c6628d0ac3a07f3ac95075af8be09317151037c6bdc8c6d451f2fb8041598d3d68d593a2964fea0fe0e4

Download Submit
memory/1956-1273-0x000007FEF60F0000-0x000007FEF67B1000-memory.dmp

Filesize
6.8MB

Download