516abd0f02ede4c63f939df815d9fdee308cdf8e04e9e5e59ede871fb3ca3700

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 18:17

Target

JinxV3.exe
Size

5.9MB
MD5

69f1c7bda59e6b967b2443b5826f1e9d
SHA1

73898ba78d08cf04842e5aebaef6afbc99507b17
SHA256

516abd0f02ede4c63f939df815d9fdee308cdf8e04e9e5e59ede871fb3ca3700
SHA512

45ce1d738d336d4901ec64aca3d48fabef2efcbed4b94eb7e3d037e3f923cd75c07cae4f67ad10fa3950817815bfbac91e84252808235cc417c3d0a50355c22c
SSDEEP

98304:opmoDUN43WQqyjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6a+tMe6e:opumWQfOjmFwDRxtYSHdK34kdai7bN3H

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2252	JinxV3.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000018704-21.dat	upx
behavioral1/memory/2252-23-0x000007FEF6680000-0x000007FEF6AE6000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2252	2220	JinxV3.exe	30
PID 2220 wrote to memory of 2252	2220	JinxV3.exe	30
PID 2220 wrote to memory of 2252	2220	JinxV3.exe	30

C:\Users\Admin\AppData\Local\Temp\JinxV3.exe
"C:\Users\Admin\AppData\Local\Temp\JinxV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\JinxV3.exe
  "C:\Users\Admin\AppData\Local\Temp\JinxV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2252

C:\Users\Admin\AppData\Local\Temp\_MEI22202\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2252-23-0x000007FEF6680000-0x000007FEF6AE6000-memory.dmp

Filesize
4.4MB

Download