4dd36b00b17dd316a92d8ec6a8536b5c3e3ff5b740b5a29ede2ac5fa9513011a

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 03:29

Target

optimizer.exe
Size

12.9MB
MD5

5fe862a2ce144cab18f8f0d293b4d00d
SHA1

51629e9c06fac3797e9209b0c72b653615280218
SHA256

4dd36b00b17dd316a92d8ec6a8536b5c3e3ff5b740b5a29ede2ac5fa9513011a
SHA512

0812f72e38a59f7bc97e397e6227d7e2c3511325ac093b4feb4cd1decb94d689ab846afc16279daf7485c1c97ede8c506b1fa0fa8a9bedeb1f0b3797ac3c14bb
SSDEEP

393216:qt12AWdqwuwq3Obs2ClzbjdQJlSwF3MnG3xl5Ze03r2W673+H:0R8tuwq3ObRqzXdQn3MGxZri3O

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2636	optimizer.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2860-0-0x000000013F050000-0x000000013F0A0000-memory.dmp	upx
behavioral1/memory/2636-49-0x000000013F050000-0x000000013F0A0000-memory.dmp	upx
behavioral1/memory/2860-96-0x000000013F050000-0x000000013F0A0000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2636	2860	optimizer.exe	30
PID 2860 wrote to memory of 2636	2860	optimizer.exe	30
PID 2860 wrote to memory of 2636	2860	optimizer.exe	30

C:\Users\Admin\AppData\Local\Temp\optimizer.exe
"C:\Users\Admin\AppData\Local\Temp\optimizer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\optimizer.exe
  "C:\Users\Admin\AppData\Local\Temp\optimizer.exe"
  2⤵
  - Loads dropped DLL
  PID:2636

C:\Users\Admin\AppData\Local\Temp\_MEI28602\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
memory/2636-49-0x000000013F050000-0x000000013F0A0000-memory.dmp

Filesize
320KB

Download
memory/2860-0-0x000000013F050000-0x000000013F0A0000-memory.dmp

Filesize
320KB

Download
memory/2860-96-0x000000013F050000-0x000000013F0A0000-memory.dmp

Filesize
320KB

Download