59c55564b5f27406601fa7b2320ecad1be74e365f1143bfbe90a143f4e0ab6a3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-01-2025 23:07

Target

ApplicationFrameHost.exe
Size

6.9MB
MD5

02bea3b0a2352c04c8cf5aa12f1cc23e
SHA1

8cdbb554184cc817cc78d024bb30aeb58cb8fa58
SHA256

59c55564b5f27406601fa7b2320ecad1be74e365f1143bfbe90a143f4e0ab6a3
SHA512

b3103c872cc599a1defc8731b8100435778249c07f5d5ec52e4aff363f161b650ce94cadce29cc15c0b859d35ad09a5f8b499f8fd7379ab19c4bb6242f83dd7a
SSDEEP

98304:I/zzdbM+Q2y+aoW0jOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbrEJ1nL2hB0Lnme:It7OjmFQR4MVGFtwLPvnL2hq+hG

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2324	ApplicationFrameHost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000191d4-21.dat	upx
behavioral1/memory/2324-23-0x000007FEF5E20000-0x000007FEF6409000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2324	2356	ApplicationFrameHost.exe	30
PID 2356 wrote to memory of 2324	2356	ApplicationFrameHost.exe	30
PID 2356 wrote to memory of 2324	2356	ApplicationFrameHost.exe	30

C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHost.exe
"C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHost.exe"
  2⤵
  - Loads dropped DLL
  PID:2324

C:\Users\Admin\AppData\Local\Temp\_MEI23562\python311.dll

Filesize
1.6MB

MD5
9e985651962ccbccdf5220f6617b444f

SHA1
9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

SHA256
3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

SHA512
8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

Download Submit
memory/2324-23-0x000007FEF5E20000-0x000007FEF6409000-memory.dmp

Filesize
5.9MB

Download