aa6f82a276e10fe74103c5625e6fe92d353eed262eae9937b37eb894067a977b

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 18:22

Target

killme.exe
Size

7.6MB
MD5

6d6138b111297afd52a8e3950dea4312
SHA1

5acbf50724807c32a06f1896d84d74898d27ea59
SHA256

aa6f82a276e10fe74103c5625e6fe92d353eed262eae9937b37eb894067a977b
SHA512

04b683850dc82e283f0329033ec278d183afdee6129f29065fca071fdb27d231786d1f5bd9897fab6ed01e1b92014150a8c03c6a6cf47998a51bc9dd54abcbb8
SSDEEP

196608:OBD+kddwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWo:S5QIHL7HmBYXrYoaUNb

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2044	killme.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001956c-21.dat	upx
behavioral1/memory/2044-23-0x000007FEF6240000-0x000007FEF68A5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2044	1976	killme.exe	30
PID 1976 wrote to memory of 2044	1976	killme.exe	30
PID 1976 wrote to memory of 2044	1976	killme.exe	30

C:\Users\Admin\AppData\Local\Temp\killme.exe
"C:\Users\Admin\AppData\Local\Temp\killme.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\killme.exe
  "C:\Users\Admin\AppData\Local\Temp\killme.exe"
  2⤵
  - Loads dropped DLL
  PID:2044

C:\Users\Admin\AppData\Local\Temp\_MEI19762\python313.dll

Filesize
1.8MB

MD5
9a3d3ae5745a79d276b05a85aea02549

SHA1
a5e60cac2ca606df4f7646d052a9c0ea813e7636

SHA256
09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889

SHA512
46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69

Download Submit
memory/2044-23-0x000007FEF6240000-0x000007FEF68A5000-memory.dmp

Filesize
6.4MB

Download