3fb7315786ca0509d9474f42492805fff4374cd46fbaee960ceb96686798e6cd

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 09:06

Target

Spoofer/RecClean.exe
Size

7.5MB
MD5

5847a34a14c128f6446123a0e6477d68
SHA1

bbee7bd5ace0ed47c025c2f30779ff900567b704
SHA256

403a7d45e143efcfb4c0435a8d62db2cbaeb714f6a15cbfc4871135616edcdfe
SHA512

d80ee3a98e854b44391a33d5e896b70ef78d98456d7ef81b14d81ccfd2476aa91b2327a8d0535c871bdbbe8e290e46695d9bf7fb22028eb6733788481fea7476
SSDEEP

196608:+KhhOFvurErvI9pWjg/Qc+4o673pNrabeSyzWtPMYnNcsY:3qurEUWjZZ4dDLIehzWtPTNzY

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2888	RecClean.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195c6-22.dat	upx
behavioral1/memory/2888-24-0x000007FEF61D0000-0x000007FEF6895000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2888	2732	RecClean.exe	30
PID 2732 wrote to memory of 2888	2732	RecClean.exe	30
PID 2732 wrote to memory of 2888	2732	RecClean.exe	30

C:\Users\Admin\AppData\Local\Temp\Spoofer\RecClean.exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer\RecClean.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\Spoofer\RecClean.exe
  "C:\Users\Admin\AppData\Local\Temp\Spoofer\RecClean.exe"
  2⤵
  - Loads dropped DLL
  PID:2888

C:\Users\Admin\AppData\Local\Temp\_MEI27322\python312.dll

Filesize
1.7MB

MD5
eb02b8268d6ea28db0ea71bfe24b15d6

SHA1
86f723fcc4583d7d2bd59ca2749d4b3952cd65a5

SHA256
80222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70

SHA512
693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2

Download Submit
memory/2888-24-0x000007FEF61D0000-0x000007FEF6895000-memory.dmp

Filesize
6.8MB

Download