214c22cc13004c4e5c7b6ef898d2c354acc6a27eb5125d8ff783c5e0b6508e06

Analysis

max time kernel
21s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08-02-2025 11:48

Target

altasinstaller.exe
Size

87.5MB
MD5

e1c8bc131cc1502e31dec5146351c557
SHA1

95792a7ed9bec9bccf88b3ecdffe1a06fb72b8ef
SHA256

214c22cc13004c4e5c7b6ef898d2c354acc6a27eb5125d8ff783c5e0b6508e06
SHA512

b5807f60f1c5d6fde557c7c27b5424e57eefe7c8c1a962f3949f3a412603f94dfb26eb18e30bd5e1ebbf705a9ef6ccd7d51fe4a74d9d525d1382257b19f4eac0
SSDEEP

1572864:z2GKlEWCsm/OkiqOv8im2AUdfmE7qliwiYgj+h58sMwhue9DOVwJq:znKe3sm/OknOv8i3XfCwy51ueV6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
812	altasinstaller.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a48-1264.dat	upx
behavioral1/memory/812-1266-0x000007FEF5F10000-0x000007FEF6502000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 812	2716	altasinstaller.exe	29
PID 2716 wrote to memory of 812	2716	altasinstaller.exe	29
PID 2716 wrote to memory of 812	2716	altasinstaller.exe	29

C:\Users\Admin\AppData\Local\Temp\altasinstaller.exe
"C:\Users\Admin\AppData\Local\Temp\altasinstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\altasinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\altasinstaller.exe"
  2⤵
  - Loads dropped DLL
  PID:812

C:\Users\Admin\AppData\Local\Temp\_MEI27162\python311.dll

Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/812-1266-0x000007FEF5F10000-0x000007FEF6502000-memory.dmp

Filesize
5.9MB

Download