93cb0b00d018b38a9ae70a690e729abccceba0cfecbb44c683860bb07e1fc141

Analysis

max time kernel
99s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
07/02/2025, 15:49

Target

Lanchez Craftrise Loader/Loader Craftrise.exe
Size

5.9MB
MD5

dedd95be1255b349794c1601974b8377
SHA1

b12e349cc9b22b51e569d8ab6778959f4c2d6458
SHA256

677362b183f8fc83923e8b4ed7c0281c45e0acac02c5fa6a8c02c6384d7cad99
SHA512

4aa34cf1553518d919c3177974202c1aa334d0e7ec2ab4f51242d67112fab4a7e6c54c0215e952af84d351aa744bea9078ce4a70483e5f168b5f17ce2ca7170d
SSDEEP

98304:DsmoDUN43WlmZjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aFtMz6E:DsumWiOjmFwDRxtYSHdK34kdai7bN3mm

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2972	Loader Craftrise.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/files/0x0005000000019bf5-21.dat	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2972	Loader Craftrise.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2972	2424	Loader Craftrise.exe	29
PID 2424 wrote to memory of 2972	2424	Loader Craftrise.exe	29
PID 2424 wrote to memory of 2972	2424	Loader Craftrise.exe	29

C:\Users\Admin\AppData\Local\Temp\Lanchez Craftrise Loader\Loader Craftrise.exe
"C:\Users\Admin\AppData\Local\Temp\Lanchez Craftrise Loader\Loader Craftrise.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\Lanchez Craftrise Loader\Loader Craftrise.exe
  "C:\Users\Admin\AppData\Local\Temp\Lanchez Craftrise Loader\Loader Craftrise.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2972

C:\Users\Admin\AppData\Local\Temp\_MEI24242\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2972-23-0x000007FEF6C60000-0x000007FEF70C6000-memory.dmp

Filesize
4.4MB

Download
memory/2972-24-0x000007FEF6C60000-0x000007FEF70C6000-memory.dmp

Filesize
4.4MB

Download