844292cd83c634311fc6571c454333799b03fd72ae4833afb3d28d7478abcd75

Resubmissions

25-01-2025 05:23

250125-f3gsqayrgn 10

25-01-2025 05:22

250125-f23c2axpgs 10

25-01-2025 03:46

250125-eb1k3swkcj 10

25-01-2025 02:39

250125-c5b4gasqan 10

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-01-2025 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

source_prepared.exe
Size

85.3MB
MD5

fad5ad41c517e152ea9d8389a5d0c582
SHA1

2a9c06459753e10e5a4c3a1851b12639b39d6bb5
SHA256

844292cd83c634311fc6571c454333799b03fd72ae4833afb3d28d7478abcd75
SHA512

ce2b1126a43460f8cc42e6856c24f352f8cf1c719f3651b14a0e292cef271b19469626697a4d4df855837aa722102c94fbc10077643da6100472eae1a624cbf7
SSDEEP

1572864:F2GKlEWPOkiqOv8im2AUdfmE7qliwiYgj+h58sMwCu42DOVwJq:FnKeKOknOv8i3XfCwy5mu4s6

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1808	source_prepared.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000020a06-1255.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1808	2900	source_prepared.exe	30
PID 2900 wrote to memory of 1808	2900	source_prepared.exe	30
PID 2900 wrote to memory of 1808	2900	source_prepared.exe	30

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI29002\python311.dll

Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/1808-1257-0x000007FEF5CE0000-0x000007FEF62D2000-memory.dmp

Filesize
5.9MB

Download