14a763180bd7b7f002597c8a39ba04c677b3c3b497f9d7d8afa5fdfe19cb71d7

Resubmissions

05/02/2025, 18:29

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/02/2025, 18:29

Target

Built.exe
Size

7.6MB
MD5

d2438feb4627664d7a9f8d1db1cd1f11
SHA1

caef5d090ac70ea30944213f3471c917eaab962b
SHA256

14a763180bd7b7f002597c8a39ba04c677b3c3b497f9d7d8afa5fdfe19cb71d7
SHA512

2dde4f7039c05f25f919a923517c1f49b478208bdfa1ac609f8b22320f3b65ebb6d7ed22e5a2f7dd6ed89f97f48fcd9cc6dcf29adda858846048d78658e2ded1
SSDEEP

196608:Ij067iuwfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAo8:lFIH20drLYRZjo8

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1740	Built.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001958b-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1740	1064	Built.exe	30
PID 1064 wrote to memory of 1740	1064	Built.exe	30
PID 1064 wrote to memory of 1740	1064	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:1740

C:\Users\Admin\AppData\Local\Temp\_MEI10642\python313.dll

Filesize
1.8MB

MD5
2a4aad7818d527bbea76e9e81077cc21

SHA1
4db3b39874c01bf3ba1ab8659957bbc28aab1ab2

SHA256
4712a6bb81b862fc292fcd857cef931ca8e4c142e70eaa4fd7a8d0a96aff5e7e

SHA512
d10631b7fc25a8b9cc038514e9db1597cec0580ee34a56ce5cfc5a33e7010b5e1df7f15ec30ebb351356e2b815528fb4161956f26b5bfaf3dce7bc6701b79c68

Download Submit
memory/1740-23-0x000007FEF5780000-0x000007FEF5DE4000-memory.dmp

Filesize
6.4MB

Download