013329a4f10332905fee3522040cbc28fdd59f40121182c4d75c542404c12230

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 17:27

Target

update.exe
Size

9.4MB
MD5

ea9f1cac2f7a211dd68c9eec6a34287e
SHA1

e15af36b5d1e627a45ae65d91eb72897608c9cda
SHA256

013329a4f10332905fee3522040cbc28fdd59f40121182c4d75c542404c12230
SHA512

e2e66f434b8e1098bb1c162138d256f22d338a25fc3cd3729005f748e78714d5a5a5c55411ac7580f7029265f69c8809839d3f1189f17d7645310b3266f36ec5
SSDEEP

196608:IyOxg3+cemXyuSyTde8j5RHvUWvofhxjno/w3iFCxHQbRpX1hgr:B73GtByxjj5RHdAxro/w3uCxHQbFhM

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2824	update.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019dc0-46.dat	upx
behavioral1/memory/2824-48-0x000007FEF6200000-0x000007FEF6665000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2824	2376	update.exe	31
PID 2376 wrote to memory of 2824	2376	update.exe	31
PID 2376 wrote to memory of 2824	2376	update.exe	31

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\update.exe
  "C:\Users\Admin\AppData\Local\Temp\update.exe"
  2⤵
  - Loads dropped DLL
  PID:2824

C:\Users\Admin\AppData\Local\Temp\_MEI23762\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2824-48-0x000007FEF6200000-0x000007FEF6665000-memory.dmp

Filesize
4.4MB

Download