4c947d5f08051634ba433e6de571e9a1b7bd53dedcc6c71b6c02368385d6760b

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 15:37

Target

sss.exe
Size

7.5MB
MD5

2f2106091b35aa847436152df5df895d
SHA1

014e3f265d7819bd963ee3b521f20086893922f4
SHA256

4c947d5f08051634ba433e6de571e9a1b7bd53dedcc6c71b6c02368385d6760b
SHA512

a91701e7390a601c0938c9b35a50f027864d3d4cb9f63962cc3b2ff0a861559ac17a4512bafa1575574cc703be8115994918a1941d0fdf946b24ab94f684d336
SSDEEP

196608:qMQCwVnurErvI9pWjgN3ZdahF0pbH1AYtWtQsNo/03WO:WVnurEUWjqeWxi6rbO

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1884	sss.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019615-21.dat	upx
behavioral1/memory/1884-23-0x000007FEF57B0000-0x000007FEF5E74000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1884	2440	sss.exe	30
PID 2440 wrote to memory of 1884	2440	sss.exe	30
PID 2440 wrote to memory of 1884	2440	sss.exe	30

C:\Users\Admin\AppData\Local\Temp\sss.exe
"C:\Users\Admin\AppData\Local\Temp\sss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\sss.exe
  "C:\Users\Admin\AppData\Local\Temp\sss.exe"
  2⤵
  - Loads dropped DLL
  PID:1884

C:\Users\Admin\AppData\Local\Temp\_MEI24402\python312.dll

Filesize
1.7MB

MD5
18677d48ba556e529b73d6e60afaf812

SHA1
68f93ed1e3425432ac639a8f0911c144f1d4c986

SHA256
8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

SHA512
a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

Download Submit
memory/1884-23-0x000007FEF57B0000-0x000007FEF5E74000-memory.dmp

Filesize
6.8MB

Download