4fd3f92b3d8ba1b07eded64bc645401a9c65fef94903c1a066221142a69d7d1e

Analysis

max time kernel
3s
max time network
5s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-01-2025 12:38

Target

vanish.exe
Size

7.5MB
MD5

f028bcb0be91f0a8c6de7e1e562a50d9
SHA1

dc7c839d28a9bf88786f99f2c980d376ac8fb502
SHA256

4fd3f92b3d8ba1b07eded64bc645401a9c65fef94903c1a066221142a69d7d1e
SHA512

12d9c85c2c2643761ffd65919b1ae86b99f00ad7eeb46333e39e1fc4de3443d2608fd293437a899e9c553a80fcca138890de891b328f3f3b0233745e31bac1e0
SSDEEP

196608:H6gFK1wfI9jUC2gYBYv3vbWY+iITm1U6fd1Eq:jF7IH2gYBgDW/TOzbR

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2416	vanish.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000018f85-21.dat	upx
behavioral1/memory/2416-23-0x000007FEF5B50000-0x000007FEF6215000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2416	1104	vanish.exe	31
PID 1104 wrote to memory of 2416	1104	vanish.exe	31
PID 1104 wrote to memory of 2416	1104	vanish.exe	31

C:\Users\Admin\AppData\Local\Temp\vanish.exe
"C:\Users\Admin\AppData\Local\Temp\vanish.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\vanish.exe
  "C:\Users\Admin\AppData\Local\Temp\vanish.exe"
  2⤵
  - Loads dropped DLL
  PID:2416

C:\Users\Admin\AppData\Local\Temp\_MEI11042\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2416-23-0x000007FEF5B50000-0x000007FEF6215000-memory.dmp

Filesize
6.8MB

Download