07fc3f63f88982e4e8add1878a7cb32b83db76355499feff43ef2af6b7a36485

Analysis

max time kernel
16s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/02/2025, 09:19

Target

upx.exe
Size

7.5MB
MD5

fb0989e95b3265b9709c5db077d5fea2
SHA1

a4526e22263bc6296f3147cd2d2a727381444444
SHA256

07fc3f63f88982e4e8add1878a7cb32b83db76355499feff43ef2af6b7a36485
SHA512

3718e24cece8078ce5871ddd407281d7b34650489c1472f339e597a31284ff2b80d8fb5248e9017d54ed3bba0e94931ccfdde25281d3447b401c9fbbcd5764d3
SSDEEP

196608:aagFzwfI9jUC2gYBYv3vbWY+iITm1U6fd1EW:cFAIH2gYBgDW/TOzbB

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2280	upx.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c3c-21.dat	upx
behavioral1/memory/2280-23-0x000007FEF6640000-0x000007FEF6D05000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2280	2576	upx.exe	29
PID 2576 wrote to memory of 2280	2576	upx.exe	29
PID 2576 wrote to memory of 2280	2576	upx.exe	29

C:\Users\Admin\AppData\Local\Temp\upx.exe
"C:\Users\Admin\AppData\Local\Temp\upx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\upx.exe
  "C:\Users\Admin\AppData\Local\Temp\upx.exe"
  2⤵
  - Loads dropped DLL
  PID:2280

C:\Users\Admin\AppData\Local\Temp\_MEI25762\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2280-23-0x000007FEF6640000-0x000007FEF6D05000-memory.dmp

Filesize
6.8MB

Download