c92388b5e5b9fe1c2ceb2aa4dc83be92299a02406e69a0422dce2b1f5228902a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 21:18

Target

MoonHub.exe
Size

5.9MB
MD5

c7dae29a10828c9a72dc7879af402c66
SHA1

05d3d8fb1b82ea331e435f71673374d2ddde718e
SHA256

c92388b5e5b9fe1c2ceb2aa4dc83be92299a02406e69a0422dce2b1f5228902a
SHA512

d9eb90c9faca70e3ff81b03d5ba142124c30469aecefa32c03481109a86929ee9844303e08b9edb0e67040d6f1d7a1fe8ea96129c52a19acdf1cb55a4699b85d
SSDEEP

98304:3IdIu4+DcdbOamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2H7MEU3QMj:Bp+DmbXeNoInY7/sHfbRy9wEAH1Yg

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2736	MoonHub.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c8f-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2736	2936	MoonHub.exe	30
PID 2936 wrote to memory of 2736	2936	MoonHub.exe	30
PID 2936 wrote to memory of 2736	2936	MoonHub.exe	30

C:\Users\Admin\AppData\Local\Temp\MoonHub.exe
"C:\Users\Admin\AppData\Local\Temp\MoonHub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\MoonHub.exe
  "C:\Users\Admin\AppData\Local\Temp\MoonHub.exe"
  2⤵
  - Loads dropped DLL
  PID:2736

C:\Users\Admin\AppData\Local\Temp\_MEI29362\python310.dll

Filesize
1.4MB

MD5
01988415e8fb076dcb4a0d0639b680d9

SHA1
91b40cffcfc892924ed59dc0664c527ff9d3f69c

SHA256
b101db1ddd659b8d8ffd8b26422fde848d5b7846e0c236f051fadb9412de6e24

SHA512
eab0c3ca4578751a671beb3da650b5e971a79798deb77472e42f43aa2bea7434ad5228a8fddbfff051ce05054dbf3422d418f42c80bc3640e0e4f43a0cf2ebbe

Download Submit
memory/2736-23-0x000007FEF68C0000-0x000007FEF6D2E000-memory.dmp

Filesize
4.4MB

Download
memory/2736-24-0x000000013F880000-0x000000013F8B5000-memory.dmp

Filesize
212KB

Download
memory/2936-45-0x000000013F880000-0x000000013F8B5000-memory.dmp

Filesize
212KB

Download