4424884762c66462951dda0088450fb830a38144fccc0dedeaae458492543a1c

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/01/2025, 08:28

Target

DDoS Tool.exe
Size

5.9MB
MD5

5443622056d2086727a3c9fb35644a84
SHA1

b9e208abb4829efa3f092ad295dd03fa32b258e3
SHA256

4424884762c66462951dda0088450fb830a38144fccc0dedeaae458492543a1c
SHA512

9ed84d49af4eb8eec73df16fc3bf1bfeb9af261c9d2601ce526cc0db815b16c8aebeae07d2d090dcef9f87bee86c30a60a6ff18094305912577d95d562c71815
SSDEEP

98304:ADmoDUN43WQqnjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aatM9U1:ADumWQSOjmFwDRxtYSHdK34kdai7bN3/

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2696	DDoS Tool.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00060000000190c6-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2696	1944	DDoS Tool.exe	30
PID 1944 wrote to memory of 2696	1944	DDoS Tool.exe	30
PID 1944 wrote to memory of 2696	1944	DDoS Tool.exe	30

C:\Users\Admin\AppData\Local\Temp\DDoS Tool.exe
"C:\Users\Admin\AppData\Local\Temp\DDoS Tool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\DDoS Tool.exe
  "C:\Users\Admin\AppData\Local\Temp\DDoS Tool.exe"
  2⤵
  - Loads dropped DLL
  PID:2696

C:\Users\Admin\AppData\Local\Temp\_MEI19442\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2696-23-0x000007FEF6390000-0x000007FEF67F6000-memory.dmp

Filesize
4.4MB

Download