308a444777e8653c064291d5fd0d64704b8897bc46996ca1ddc42e5f282f7bb6

Analysis

max time kernel
843s
max time network
850s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 14:43

Target

source_prepared.exe
Size

39.2MB
MD5

bf76d05b1904f14daeb4660662d5c2bf
SHA1

f14a73cf2706c694319f11740338cd4197c82508
SHA256

308a444777e8653c064291d5fd0d64704b8897bc46996ca1ddc42e5f282f7bb6
SHA512

3ef96e066241dedcb9e8f98a77a0446f36ecdebb33aa2946ecfae2806ce1d29fed420abd2d4526cad53439c5d0b3e700d3f4592ed0ada20e7e8613b1fbade6b3
SSDEEP

786432:MrJ1KFzcY87W4Fi6/9x94MH+Q7/i50eqd2QJNLtv3Tq+AYOqpi:aJ1KxE7WuiY4MHHLeqPNLtDaYvp

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1456	source_prepared.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a469-144.dat	upx
behavioral1/memory/1456-146-0x000007FEF6350000-0x000007FEF67B6000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1456	2240	source_prepared.exe	31
PID 2240 wrote to memory of 1456	2240	source_prepared.exe	31
PID 2240 wrote to memory of 1456	2240	source_prepared.exe	31

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:1456

C:\Users\Admin\AppData\Local\Temp\_MEI22402\python310.dll

Filesize
1.4MB

MD5
b805cebb0242b3bbfe810a19c2b44e3d

SHA1
62d71b686b64e6efd58852a5e59f4b00cec18f30

SHA256
2d2d5746d6a066fcc3e7b8c041ffb7c7722c14b148aed923387dbacc951d732b

SHA512
d46a5b3274aed182d30647d461d1dc7bd2599a43b1914d5a5e882c4298ecf4f11c64272db351257f836806ae55d5f1a0c1369f4159df09c8d7aea9a52d2e1acd

Download Submit
memory/1456-146-0x000007FEF6350000-0x000007FEF67B6000-memory.dmp

Filesize
4.4MB

Download