cca79252d0da785683330467edf0eb1dde70ef7f74604631514fb5f673eb4520

Analysis

max time kernel
17s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 02:06

Target

FairCraft installer.exe
Size

700.0MB
MD5

ea6ee17762e752a2b108b20f2ce785d9
SHA1

fe1cca8c477790cd00a3bff98b58219c7d54379e
SHA256

cca79252d0da785683330467edf0eb1dde70ef7f74604631514fb5f673eb4520
SHA512

2ddfd3b05e9e490e03d30c352762ca4a59e0d49e7f02a23bf355ee2c8d37a9837c6deaa6695c5be4842548cc17ddc201d2e904abad2c2eeca28f3726c67af7bb
SSDEEP

786432:nDySd8YyEhkXm4mdUvOhvk1Hkv1dni9UqaQHqM5:DyHYBrbhcSiqa

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2384	FairCraft installer.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4aa-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2384	2556	FairCraft installer.exe	30
PID 2556 wrote to memory of 2384	2556	FairCraft installer.exe	30
PID 2556 wrote to memory of 2384	2556	FairCraft installer.exe	30

C:\Users\Admin\AppData\Local\Temp\FairCraft installer.exe
"C:\Users\Admin\AppData\Local\Temp\FairCraft installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\FairCraft installer.exe
  "C:\Users\Admin\AppData\Local\Temp\FairCraft installer.exe"
  2⤵
  - Loads dropped DLL
  PID:2384

C:\Users\Admin\AppData\Local\Temp\_MEI25562\python312.dll

Filesize
1.7MB

MD5
2996cbf9598eb07a64d66d4c3aba4b10

SHA1
ac176ab53cdef472770d27a38db5bd6eb71a5627

SHA256
feba57a74856dedb9d9734d12c640ca7f808ead2db1e76a0f2bcf1e4561cd03f

SHA512
667e117683d94ae13e15168c477800f1cd8d840e316890ec6f41a6e4cefd608536655f3f6d7065c51c6b1b8e60dd19aa44da3f9e8a70b94161fd7dc3abf5726c

Download Submit
memory/2384-24-0x000007FEF59D0000-0x000007FEF6092000-memory.dmp

Filesize
6.8MB

Download