be86be2ed524d887a9fb5915be201c5f45c8fb40cac116b3156fca4c65e562be

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 07:39

Target

xray.exe
Size

5.9MB
MD5

08eca9171f36a8870b914cc3483289ad
SHA1

ad19c17528e1729fcc886b81a75459fa166e8333
SHA256

be86be2ed524d887a9fb5915be201c5f45c8fb40cac116b3156fca4c65e562be
SHA512

4771a72151ddafd37c06bbf1e3c4f4a4a0273bf37aac5fc2827aad15a30eee86793885450b8fbb0b368bf752770032340ccc5a570383deb8679577442b205b72
SSDEEP

98304:GEmoDUN43Wlmk3ZjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aitMr:GEumWzOjmFwDRxtYSHdK34kdai7bN3ml

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2828	xray.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c3c-21.dat	upx
behavioral1/memory/2828-23-0x000007FEF7130000-0x000007FEF7596000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2828	1612	xray.exe	30
PID 1612 wrote to memory of 2828	1612	xray.exe	30
PID 1612 wrote to memory of 2828	1612	xray.exe	30

C:\Users\Admin\AppData\Local\Temp\xray.exe
"C:\Users\Admin\AppData\Local\Temp\xray.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\xray.exe
  "C:\Users\Admin\AppData\Local\Temp\xray.exe"
  2⤵
  - Loads dropped DLL
  PID:2828

C:\Users\Admin\AppData\Local\Temp\_MEI16122\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2828-23-0x000007FEF7130000-0x000007FEF7596000-memory.dmp

Filesize
4.4MB

Download