654e341300b8a7ac95c4be79d5379f740ccd2009ca2045e60bc8afb119da25db

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 15:20

Target

test.exe
Size

5.8MB
MD5

bdb60ef4473362cf5a875762fe776dd1
SHA1

ccaebfb1b45911d838a3d5a60b5378b90c5807ad
SHA256

654e341300b8a7ac95c4be79d5379f740ccd2009ca2045e60bc8afb119da25db
SHA512

6fa40e41a8bbe1079b023d6942eccf4a3f008698772c79fef6af252d6fecb9c5b3bad5a7a4df585603d0e3b4abb9b8d48d9b8493754e5f23cdcc2804a52a9c0b
SSDEEP

98304:Y9mDSr7nRHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nIetd8O:Y9mD6nRHvUWvozWOxu9kXwvdbDlA03Nf

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2572	test.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019509-21.dat	upx
behavioral1/memory/2572-23-0x000007FEF6430000-0x000007FEF689A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2572	2628	test.exe	30
PID 2628 wrote to memory of 2572	2628	test.exe	30
PID 2628 wrote to memory of 2572	2628	test.exe	30

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe"
  2⤵
  - Loads dropped DLL
  PID:2572

C:\Users\Admin\AppData\Local\Temp\_MEI26282\python310.dll

Filesize
1.4MB

MD5
b3ae142a88ff3760a852ba7facb901bc

SHA1
ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

SHA256
2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

SHA512
3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

Download Submit
memory/2572-23-0x000007FEF6430000-0x000007FEF689A000-memory.dmp

Filesize
4.4MB

Download