5e8c2408b4f28f275bf3fad412eeb877e5d430e4d9e9e2086b3eaaed1be2c6b5

Analysis

max time kernel
73s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09/02/2025, 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Releasev0.21.0Macro.exe
Size

6.7MB
MD5

97ecf1c42bdd41b552efab84abec311f
SHA1

d3c3761fc58c8661b1dd388bb48a10fff3e32bbc
SHA256

5e8c2408b4f28f275bf3fad412eeb877e5d430e4d9e9e2086b3eaaed1be2c6b5
SHA512

f359634c7bd2a73a1890e256bfd08b830d7eed25a45207af98ca208a975ba833dfbb7ddaaeb49fd1890ac8d64b6d886e0171f78a2c1a95326facb51b5a96ec08
SSDEEP

196608:7NrAELeywI6DOYbwtZVZibPpG2QdetVg6naEku0:xdC5BbeYbhG2QdOVnaER0

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
3032	Releasev0.21.0Macro.exe
3032	Releasev0.21.0Macro.exe
3032	Releasev0.21.0Macro.exe
3032	Releasev0.21.0Macro.exe
3032	Releasev0.21.0Macro.exe
3032	Releasev0.21.0Macro.exe
3032	Releasev0.21.0Macro.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a404-73.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3032	1628	Releasev0.21.0Macro.exe	30
PID 1628 wrote to memory of 3032	1628	Releasev0.21.0Macro.exe	30
PID 1628 wrote to memory of 3032	1628	Releasev0.21.0Macro.exe	30

C:\Users\Admin\AppData\Local\Temp\Releasev0.21.0Macro.exe
"C:\Users\Admin\AppData\Local\Temp\Releasev0.21.0Macro.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\Releasev0.21.0Macro.exe
  "C:\Users\Admin\AppData\Local\Temp\Releasev0.21.0Macro.exe"
  2⤵
  - Loads dropped DLL
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI16282\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
4a060eec454c222a5381cd359dc00b81

SHA1
21e1bc115d04a74779e955ea16a16bd71454d9bb

SHA256
e6b2b05e14a6c6f5381e8f4c7f4fd28a499246fb4c8eafe1f08014b9273d70df

SHA512
16fb1f4ccdad05d07feb62e0cd078401f4023f9fab0fb15e52b927ca413e65eb32c2932ba59dbfa7f7ee0e8a8053748e27f2757e82e600db812271aa44a9433c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16282\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
50abf0a7ee67f00f247bada185a7661c

SHA1
0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

SHA256
f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

SHA512
c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16282\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
4c26932f8f1f490017add31f5ec0a533

SHA1
0da01a7c89b506fe3fd939344bb51b976efb3207

SHA256
dd3843c2e46b4e926c36150d614efe02ca0ebc1f767f64f471568adc35c2ef23

SHA512
eb2b87d187991fdc8e3a6577f20622d2d4a2a994dd375d8c27e1434ce786596533eacfbde8714db9959d88d6bcb91fdc8079c60c23f0eb920ba45c546a44e523

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16282\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
a6776c201baae1dd6f88048d7747d14c

SHA1
646119d2e440e6dad0ffb0fe449ab4fc27f09fbe

SHA256
ee99af71c347ff53c4e15109cb597759e657a3e859d9530680eeea8bb0540112

SHA512
a9137af8529fd96dbba22c5179a16d112ec0bfab9792babe0a9f1cca27408eff73ba89f498cb5f941a5aa44555529ee10484e6ca4a3fbf1627523acfde622b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16282\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
10d466341e7ece8cf75b5d026105741b

SHA1
31d1e9b9a4511156695b5aa33d65b6a36f8139c2

SHA256
5ce391edb33c7055e724a4c3cecc64d16ba2aa4724cb99cd5aed00b0cecfbc82

SHA512
8778fd10c7360bd87db048a2b2ca6603455fd8cb4d0e18709f106b55db7cc92e7d6dc45385ff9def445b368376462e7d253442728d5e759faa97299b67a59e21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16282\python310.dll

Filesize
1.4MB

MD5
76cb307e13fbbfb9e466458300da9052

SHA1
577f0029ac8c2dd64d6602917b7a26bcc2b27d2b

SHA256
95066c06d9ed165f0b6f34079ed917df1111bd681991f96952d9ee35d37dc615

SHA512
f15b17215057433d88f1a8e05c723a480b4f8bc56d42185c67bb29a192f435f54345aa0f6d827bd291e53c46a950f2e01151c28b084b7478044bd44009eced8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16282\ucrtbase.dll

Filesize
1.1MB

MD5
3b337c2d41069b0a1e43e30f891c3813

SHA1
ebee2827b5cb153cbbb51c9718da1549fa80fc5c

SHA256
c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

SHA512
fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

Download Submit
memory/3032-75-0x000007FEF6980000-0x000007FEF6DEE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads