0f9a723b42319e0b131ea7c1dda2907e7766937cc296840621be757d1be83532

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/02/2025, 15:50

Target

Mercurial.exe
Size

9.8MB
MD5

3bf880794834e8bcbbbf9060734acfd8
SHA1

52339a5a36704004d492f5216e79a0568c90199d
SHA256

0f9a723b42319e0b131ea7c1dda2907e7766937cc296840621be757d1be83532
SHA512

9f782e3b383243ee26fd9eac9981f84a96f9820705b691c13f74e4a0c18cd06744618486988489113ae2da25df65dae590035dbcc2f85b43797432c9b6ff4cb5
SSDEEP

196608:fsOOjmFQR4MVGFtwKPmF9mhAqaeGq8PHiFRV104:kKtM5KPm7mCeb8PHma4

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2180	Mercurial.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00060000000190e1-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2180	2856	Mercurial.exe	31
PID 2856 wrote to memory of 2180	2856	Mercurial.exe	31
PID 2856 wrote to memory of 2180	2856	Mercurial.exe	31

C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
  "C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
  2⤵
  - Loads dropped DLL
  PID:2180

C:\Users\Admin\AppData\Local\Temp\_MEI28562\python311.dll

Filesize
1.6MB

MD5
9e985651962ccbccdf5220f6617b444f

SHA1
9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

SHA256
3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

SHA512
8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

Download Submit
memory/2180-24-0x000007FEF57C0000-0x000007FEF5DA9000-memory.dmp

Filesize
5.9MB

Download