71c387334cd87ac32a494dca0c3aacf80b602cfb798085ca27214f0d7f225141

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 01:55

Target

noname2.exe
Size

6.5MB
MD5

09371d686d4f402f798fd1d80a90f17f
SHA1

9edb34457c2941d31b646e11abd7bbec2a79fa6c
SHA256

71c387334cd87ac32a494dca0c3aacf80b602cfb798085ca27214f0d7f225141
SHA512

342e18098c887b0c35cd27d4293360aefbb8b78cf46806c2d80713195e5ff222205f8414b02a2ac4bbc3dba9f435de059d24ec10b468bd6d735d3b2c6bd06b36
SSDEEP

196608:5JmD6nASmxZRHvUWvozWOxu9kXwvdbDlA03NhnZetJ8w3hULDN9:jGmAxxZRHdKbAlbZA03bZMZxAR9

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2732	noname2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4a9-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 2732	908	noname2.exe	29
PID 908 wrote to memory of 2732	908	noname2.exe	29
PID 908 wrote to memory of 2732	908	noname2.exe	29

C:\Users\Admin\AppData\Local\Temp\noname2.exe
"C:\Users\Admin\AppData\Local\Temp\noname2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\noname2.exe
  "C:\Users\Admin\AppData\Local\Temp\noname2.exe"
  2⤵
  - Loads dropped DLL
  PID:2732

C:\Users\Admin\AppData\Local\Temp\_MEI9082\python310.dll

Filesize
1.4MB

MD5
b3ae142a88ff3760a852ba7facb901bc

SHA1
ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

SHA256
2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

SHA512
3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

Download Submit
memory/2732-24-0x000007FEF6AF0000-0x000007FEF6F5A000-memory.dmp

Filesize
4.4MB

Download