2458d71acea70c16e35b4e70d32799f7234e77396b91d38b8db7448a7d3acdbf

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 04:23

Target

Feather Boostrap.exe
Size

7.6MB
MD5

348dbc907eb4d0123302bd6e1adab458
SHA1

0f2ccd3ff897b75f2b62e79d468dbac2acb48ba7
SHA256

b67a2978d34f7b191836f5c18c128d41374fc73767624c7170b9561c1276676a
SHA512

6d15374e0a7d2c56284af70b59f04ec2e4a399f79838bf2cb566c72f61e4022f12a01821262cb1110423d8b051d1fcad5245ba9b20785d26538b8ae2d4105c7f
SSDEEP

196608:OTc1dEjPwfI9jUCnORird1KfbLOYgN2oc+nBIdAxI:V8EIHOQ76bynnBI9

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1684	Feather Boostrap.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000193af-21.dat	upx
behavioral1/memory/1684-23-0x000007FEF5BF0000-0x000007FEF62B1000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1684	2396	Feather Boostrap.exe	30
PID 2396 wrote to memory of 1684	2396	Feather Boostrap.exe	30
PID 2396 wrote to memory of 1684	2396	Feather Boostrap.exe	30

C:\Users\Admin\AppData\Local\Temp\Feather Boostrap.exe
"C:\Users\Admin\AppData\Local\Temp\Feather Boostrap.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\Feather Boostrap.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather Boostrap.exe"
  2⤵
  - Loads dropped DLL
  PID:1684

C:\Users\Admin\AppData\Local\Temp\_MEI23962\python312.dll

Filesize
1.7MB

MD5
3c5c6c489c358149c970b3b2e562be5f

SHA1
2f1077db20405b0a176597ed34a10b4730af3ca9

SHA256
73a22a12ea3d7f763ed2cea94bb877441f4134b40f043c400648d85565757741

SHA512
d3fb4e5df409bf2de4f5dc5d02d806aee649a21c339c648248b835c3d5d66ab88312c076c149eaadaa3ce0fb43e6fa293bfa369d8876d6eb18742bd9d12448e3

Download Submit
memory/1684-23-0x000007FEF5BF0000-0x000007FEF62B1000-memory.dmp

Filesize
6.8MB

Download