44539504c01cebfeaed6d696e5d9aa0afee357f6b722afc3a9e6914b72adf2da

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-01-2025 14:28

Target

TestApp2.exe
Size

29.7MB
MD5

ef2206aad0acab339b55b746dc46b5b7
SHA1

dd203e86fcfd8025bee854f5719345a0cf0c3407
SHA256

44539504c01cebfeaed6d696e5d9aa0afee357f6b722afc3a9e6914b72adf2da
SHA512

b514b35cac3bc7a4d35bf9c0b695fd3c892d26c8d008878ce451bf1af7564e19fb355e963311e4cab7070846a92dfefc97df1375a2b2f75b5afaba86a1663997
SSDEEP

786432:Qow/lhONW87i8m1NxOcl8dPXB6BYeBLpdSYCxeDs5Vd:MlhsWR8mxBlmPxaYeBl1s5

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2892	TestApp2.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a6e-1155.dat	upx
behavioral1/memory/2892-1157-0x000007FEF6660000-0x000007FEF6CC5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2892	2104	TestApp2.exe	30
PID 2104 wrote to memory of 2892	2104	TestApp2.exe	30
PID 2104 wrote to memory of 2892	2104	TestApp2.exe	30

C:\Users\Admin\AppData\Local\Temp\TestApp2.exe
"C:\Users\Admin\AppData\Local\Temp\TestApp2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\TestApp2.exe
  "C:\Users\Admin\AppData\Local\Temp\TestApp2.exe"
  2⤵
  - Loads dropped DLL
  PID:2892

C:\Users\Admin\AppData\Local\Temp\_MEI21042\python313.dll

Filesize
1.8MB

MD5
13e0653e90a091bde333f7e652ac6f8b

SHA1
130f3271120487b4aac482af56f4de6673aaaeda

SHA256
a89f9220c5afcb81b9a91f00b3bea9ed21ebd2cbae00785cbc2db264d90c862c

SHA512
ad513df8f9a53cb3a8e5bc430a977c4079e7d7547fce43fe29288988ee458ff2ea922eb979582fe4c276e58cd6ef8d771bf6535170554b82c5d54d87caaf5366

Download Submit
memory/2892-1157-0x000007FEF6660000-0x000007FEF6CC5000-memory.dmp

Filesize
6.4MB

Download