a0e9c6b53509230115143f0089abe9ee276e89fdc9ca47b89ad4844ede9460a4

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 16:41

Target

source_prepared.exe
Size

81.2MB
MD5

7367cf234782b6cae4af57c00ff0e5eb
SHA1

b1c3e31155ba8438d768e78abf497a73e54d240d
SHA256

a0e9c6b53509230115143f0089abe9ee276e89fdc9ca47b89ad4844ede9460a4
SHA512

8361d9644a2df04318bee0ada7b22a0e98c4a1b83cee4dd68e54ec77ed9388acefd7a10ecb603e9f044c53988e305853a91ca54f3fba20dcac90bee59286204e
SSDEEP

1572864:82GKlXshW/ismwSk8IpG7V+VPhqO+ynE7Cli9iYgj+h58sMwIIVeo6O8dZit:8nKROUismwSkB05awO+y9wH5kQeo6p

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1708	source_prepared.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a71-1264.dat	upx
behavioral1/memory/1708-1266-0x000007FEF62C0000-0x000007FEF68A9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1708	2552	source_prepared.exe	30
PID 2552 wrote to memory of 1708	2552	source_prepared.exe	30
PID 2552 wrote to memory of 1708	2552	source_prepared.exe	30

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:1708

C:\Users\Admin\AppData\Local\Temp\_MEI25522\python311.dll

Filesize
1.6MB

MD5
0b66c50e563d74188a1e96d6617261e8

SHA1
cfd778b3794b4938e584078cbfac0747a8916d9e

SHA256
02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

SHA512
37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

Download Submit
memory/1708-1266-0x000007FEF62C0000-0x000007FEF68A9000-memory.dmp

Filesize
5.9MB

Download