831d7313ac67c8f1c22c5eb2ba92d390243faf2530b51cf2ee757a9c69b780a3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 14:35

Target

RYCCC (2).exe
Size

7.4MB
MD5

54fc29dea207d04ad17fb681938ebf6f
SHA1

6d65f77dc3bebed287e44797109e399030025669
SHA256

831d7313ac67c8f1c22c5eb2ba92d390243faf2530b51cf2ee757a9c69b780a3
SHA512

a8f0d2359d205bb756ef5253322f4401844e1c7a7ece17dc37c83e597760866d0bab470c13d2587c932b4c3dc1766944dbaf756d9817c4578d7e073fd3b50002
SSDEEP

196608:AwmDZsSG14RRHvUWvozWOxu9kXwvdbDlA03NhnGetp8wPhUaPlw:RGTRHdKbAlbZA03bGM5ZF9w

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2552	RYCCC (2).exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000018704-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2552	2380	RYCCC (2).exe	30
PID 2380 wrote to memory of 2552	2380	RYCCC (2).exe	30
PID 2380 wrote to memory of 2552	2380	RYCCC (2).exe	30

C:\Users\Admin\AppData\Local\Temp\RYCCC (2).exe
"C:\Users\Admin\AppData\Local\Temp\RYCCC (2).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\RYCCC (2).exe
  "C:\Users\Admin\AppData\Local\Temp\RYCCC (2).exe"
  2⤵
  - Loads dropped DLL
  PID:2552

C:\Users\Admin\AppData\Local\Temp\_MEI23802\python310.dll

Filesize
1.4MB

MD5
b3ae142a88ff3760a852ba7facb901bc

SHA1
ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

SHA256
2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

SHA512
3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

Download Submit
memory/2552-24-0x000007FEF5920000-0x000007FEF5D8A000-memory.dmp

Filesize
4.4MB

Download