ca4c698151072be722f3b0a2a2fc26c7237fb2d4d16a6874273609aac3d6552e

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-01-2025 15:11

Target

Built.exe
Size

7.5MB
MD5

72ecef7f3ad67a7347b62f8f315dba58
SHA1

a55209c42ae2e205ef98ac6d04dc658b04e5151e
SHA256

ca4c698151072be722f3b0a2a2fc26c7237fb2d4d16a6874273609aac3d6552e
SHA512

789f81c4b3433d44fc0141a260546a317005595193c6cf5402a589667f4d1d74b221ee7fb82b709a6e9d2ab183c938a7b90a10a2c4238560fb5aeb8b1928b545
SSDEEP

196608:eYhhOJpurErvI9pWjg/Qc+4o673pNrabeSyzWtPMYnNcsq:NgpurEUWjZZ4dDLIehzWtPTNzq

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2740	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195b7-21.dat	upx
behavioral1/memory/2740-23-0x000007FEF6210000-0x000007FEF68D5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2740	3052	Built.exe	30
PID 3052 wrote to memory of 2740	3052	Built.exe	30
PID 3052 wrote to memory of 2740	3052	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2740

C:\Users\Admin\AppData\Local\Temp\_MEI30522\python312.dll

Filesize
1.7MB

MD5
eb02b8268d6ea28db0ea71bfe24b15d6

SHA1
86f723fcc4583d7d2bd59ca2749d4b3952cd65a5

SHA256
80222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70

SHA512
693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2

Download Submit
memory/2740-23-0x000007FEF6210000-0x000007FEF68D5000-memory.dmp

Filesize
6.8MB

Download