11bfbab573a9ffdc69dd17a0c61a5b1db5abe6786c60ad7eaefad770ab9a5c29

Analysis

max time kernel
2s
max time network
0s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06/02/2025, 04:55

Target

Built.exe
Size

7.6MB
MD5

ae75491df3e7e280a5c42099a8669de5
SHA1

9e4827e7f94266da0db62b49213c7a29b99a7d38
SHA256

11bfbab573a9ffdc69dd17a0c61a5b1db5abe6786c60ad7eaefad770ab9a5c29
SHA512

0c47ca68af562729481175e7531c5dde02647c2a598486e35f4cbba86bb831697475d186ab5963381f8b620d79ad7d6205ca21fdd6b24cb0ac83b7d483614c4d
SSDEEP

196608:1+067obwfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAo0:OIH20drLYRZjo0

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2316	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019581-21.dat	upx
behavioral1/memory/2316-23-0x000007FEF51B0000-0x000007FEF5814000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2316	1196	Built.exe	30
PID 1196 wrote to memory of 2316	1196	Built.exe	30
PID 1196 wrote to memory of 2316	1196	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2316

C:\Users\Admin\AppData\Local\Temp\_MEI11962\python313.dll

Filesize
1.8MB

MD5
2a4aad7818d527bbea76e9e81077cc21

SHA1
4db3b39874c01bf3ba1ab8659957bbc28aab1ab2

SHA256
4712a6bb81b862fc292fcd857cef931ca8e4c142e70eaa4fd7a8d0a96aff5e7e

SHA512
d10631b7fc25a8b9cc038514e9db1597cec0580ee34a56ce5cfc5a33e7010b5e1df7f15ec30ebb351356e2b815528fb4161956f26b5bfaf3dce7bc6701b79c68

Download Submit
memory/2316-23-0x000007FEF51B0000-0x000007FEF5814000-memory.dmp

Filesize
6.4MB

Download