84a5b83dd78c6d72b4076fd75b8c1842b5e888910c0d66f8d17dad0bf34f1212

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-01-2025 18:44

Target

Featherclient.exe
Size

83.1MB
MD5

8945dc1c4c07abb9e78ffbca46728216
SHA1

38d75193896220521c105d495cc3d589fc64fef4
SHA256

84a5b83dd78c6d72b4076fd75b8c1842b5e888910c0d66f8d17dad0bf34f1212
SHA512

2ea96437d58f16586789a2e1a1e6978fa685007848adec82486efde60c80d662dc97b3c0bb8ff9af0e4890c74f8f15c319f49b0d00b9c8c06ff48635c534c32f
SSDEEP

1572864:iVjlaWaDFm7OkiqOv8im2AUdfzE7ylhBiYweyJulZUdg2rUAuaqZ9UaR:uAFFm7OknOv8i3XfjLGpuSrI9U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1084	Featherclient.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020aa8-1268.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1084	1964	Featherclient.exe	30
PID 1964 wrote to memory of 1084	1964	Featherclient.exe	30
PID 1964 wrote to memory of 1084	1964	Featherclient.exe	30

C:\Users\Admin\AppData\Local\Temp\Featherclient.exe
"C:\Users\Admin\AppData\Local\Temp\Featherclient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\Featherclient.exe
  "C:\Users\Admin\AppData\Local\Temp\Featherclient.exe"
  2⤵
  - Loads dropped DLL
  PID:1084

C:\Users\Admin\AppData\Local\Temp\_MEI19642\python312.dll

Filesize
1.7MB

MD5
73ecc8d4decf6f198d6505bde482e37a

SHA1
ed30f5bd628b4a5de079062ea9b909b99807021c

SHA256
b598545be6c99f7db852a510768ecf80ed353fad3989af342bc6faf66fd64648

SHA512
56923c477d35680aed73980e0404768f841da868ca11f39888caff0fc06f4ae906551b4bd47f98dda2cc2d81ea9eed17fa7c17aa59d4d7c37510ba24d7ac5976

Download Submit
memory/1084-1270-0x000007FEF5700000-0x000007FEF5DC5000-memory.dmp

Filesize
6.8MB

Download