de8d0797bed607ded0c487cbf86b4bdd095e1f73b7e432bddf821a4d221132b1

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 08:15

Target

ZenFN.exe
Size

5.9MB
MD5

6fa7977c798d8f612b10d79ba9504660
SHA1

3ffe480ea280907ce27143c83674d8cd1aff938a
SHA256

de8d0797bed607ded0c487cbf86b4bdd095e1f73b7e432bddf821a4d221132b1
SHA512

102b895a7adf1b3c3f7514174301525522e02be74f729a2cd09b31e14711469389990cdc66ccc41aef8d702e34be7292e5d468028af67d233c829f0e3fad0cf3
SSDEEP

98304:AifrAEHhCrJi65sn6Wfz7pnxCb3AtZC0VZHtKpbzL8SG2XATHTm9Uk6nRxbsYvNr:A+rAE+LDOYbwtZVZibPpG2QrTsU5nzss

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2676	ZenFN.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019431-21.dat	upx
behavioral1/memory/2676-23-0x000007FEF6740000-0x000007FEF6BAE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2676	2644	ZenFN.exe	30
PID 2644 wrote to memory of 2676	2644	ZenFN.exe	30
PID 2644 wrote to memory of 2676	2644	ZenFN.exe	30

C:\Users\Admin\AppData\Local\Temp\ZenFN.exe
"C:\Users\Admin\AppData\Local\Temp\ZenFN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\ZenFN.exe
  "C:\Users\Admin\AppData\Local\Temp\ZenFN.exe"
  2⤵
  - Loads dropped DLL
  PID:2676

C:\Users\Admin\AppData\Local\Temp\_MEI26442\python310.dll

Filesize
1.4MB

MD5
76cb307e13fbbfb9e466458300da9052

SHA1
577f0029ac8c2dd64d6602917b7a26bcc2b27d2b

SHA256
95066c06d9ed165f0b6f34079ed917df1111bd681991f96952d9ee35d37dc615

SHA512
f15b17215057433d88f1a8e05c723a480b4f8bc56d42185c67bb29a192f435f54345aa0f6d827bd291e53c46a950f2e01151c28b084b7478044bd44009eced8f

Download Submit
memory/2676-23-0x000007FEF6740000-0x000007FEF6BAE000-memory.dmp

Filesize
4.4MB

Download