1e460d6497fb44ad2dd621290380c96858382b8a773e6871c4ffc0ef5a95a196

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 16:08

Target

VexWare (5).exe
Size

87.6MB
MD5

318b6716eb2f476d49dc2b5696e72095
SHA1

12f88564f2001f7ac1ffe0a33c024beaea8e4d51
SHA256

1e460d6497fb44ad2dd621290380c96858382b8a773e6871c4ffc0ef5a95a196
SHA512

d009ca79c889dde0a58c06014f5f646aae74deebd5ec358ebdcebce712096afefc677db20b2b5689846628ae903d2723d8a01dd43e66771b4faefb8790de99d5
SSDEEP

1572864:A2GKlXebWqsm/OkiqOv8im2A3+T9E7CliHiYgj+h58sMw5I6e389PcJFJZ:AnKRCtsm/OknOv8i36+TXwZ5FHe38gJ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2868	VexWare (5).exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020ad1-1264.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2868	2820	VexWare (5).exe	30
PID 2820 wrote to memory of 2868	2820	VexWare (5).exe	30
PID 2820 wrote to memory of 2868	2820	VexWare (5).exe	30

C:\Users\Admin\AppData\Local\Temp\VexWare (5).exe
"C:\Users\Admin\AppData\Local\Temp\VexWare (5).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\VexWare (5).exe
  "C:\Users\Admin\AppData\Local\Temp\VexWare (5).exe"
  2⤵
  - Loads dropped DLL
  PID:2868

C:\Users\Admin\AppData\Local\Temp\_MEI28202\python311.dll

Filesize
1.6MB

MD5
8ea69ca2292c3af9cdb46dded91bc837

SHA1
72de7df68b2c336720d1528c34f21ff00ed7a2ce

SHA256
3512c3a7ad74af034f51eba397c0e4716f592861ea3030745e8fd4dc8f9bca49

SHA512
fb317bab11c922dc183d834b770e37e382b9cf3ab1ea95e9bca8d73ed1e23cc9ef2b6aea4a20d4637eba34276c81a6eee54b00cb146f825ef554d81387ae4ddc

Download Submit
memory/2868-1266-0x000007FEF6800000-0x000007FEF6DE9000-memory.dmp

Filesize
5.9MB

Download