50d8427c67ae093e01fd83ed3c3d5af142241ad1fa775066b6159106d89ba28d

Analysis

max time kernel
7s
max time network
1s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-01-2025 01:46

Target

loader.exe
Size

7.4MB
MD5

f3e89323904b96d35302e0c76975a569
SHA1

10e539fc53fb8546c5dc7c3b3d2b85961d000794
SHA256

50d8427c67ae093e01fd83ed3c3d5af142241ad1fa775066b6159106d89ba28d
SHA512

7c7b4964967f2b0cdcb2ea8fc1b3a5dc6f3e3e7b3795ed46f953345fa2c1f80f7962156a2ff44501b2b06c7c0c386ca3e0297141b4778d2fb931003914d5ef0e
SSDEEP

98304:e6Si8TR7urErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EBKhOh112mJ5T:e9burErvI9pWjgfPvzm6gsFE44fr9

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2920	loader.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019431-21.dat	upx
behavioral1/memory/2920-23-0x000007FEF65B0000-0x000007FEF6BA2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2920	2232	loader.exe	30
PID 2232 wrote to memory of 2920	2232	loader.exe	30
PID 2232 wrote to memory of 2920	2232	loader.exe	30

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Loads dropped DLL
  PID:2920

C:\Users\Admin\AppData\Local\Temp\_MEI22322\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2920-23-0x000007FEF65B0000-0x000007FEF6BA2000-memory.dmp

Filesize
5.9MB

Download