aa9fea628399566aea6b47fae693e037e22fba51902b37d525880f10cf5ee50f

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09/02/2025, 10:20

Target

tools/BlueCode Hash Finder/BlueCode_HashFinder_Lite_2.5.exe
Size

10.3MB
MD5

70efd6bd3d54f1da8bf7929806d56073
SHA1

c5dbca3388518bff672a1ab2b7b9de383be6ba6b
SHA256

1f051c15bec28fe6071d0d497fdc6bf8ea5a869f255ad7539bac2141133e1ab2
SHA512

2f6f532ad299ebaf1aa17e71e64cb70297aada10d04b9e4de0ac26d93ce99878a7eb25d1dd1d3c14685ba8cf1b29302fc326cfa35b4c2664771e2d09f97e512b
SSDEEP

196608:UbD+kdDNMG3Mioq+rj5W/b1TwfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWz:M5hN3MvqQ8SIHL7HmBYXrYSaUNZ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2724	BlueCode_HashFinder_Lite_2.5.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a48f-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2724	2532	BlueCode_HashFinder_Lite_2.5.exe	31
PID 2532 wrote to memory of 2724	2532	BlueCode_HashFinder_Lite_2.5.exe	31
PID 2532 wrote to memory of 2724	2532	BlueCode_HashFinder_Lite_2.5.exe	31

C:\Users\Admin\AppData\Local\Temp\tools\BlueCode Hash Finder\BlueCode_HashFinder_Lite_2.5.exe
"C:\Users\Admin\AppData\Local\Temp\tools\BlueCode Hash Finder\BlueCode_HashFinder_Lite_2.5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\tools\BlueCode Hash Finder\BlueCode_HashFinder_Lite_2.5.exe
  "C:\Users\Admin\AppData\Local\Temp\tools\BlueCode Hash Finder\BlueCode_HashFinder_Lite_2.5.exe"
  2⤵
  - Loads dropped DLL
  PID:2724

C:\Users\Admin\AppData\Local\Temp\_MEI25322\python313.dll

Filesize
1.8MB

MD5
9a3d3ae5745a79d276b05a85aea02549

SHA1
a5e60cac2ca606df4f7646d052a9c0ea813e7636

SHA256
09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889

SHA512
46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69

Download Submit
memory/2724-24-0x000007FEF5BB0000-0x000007FEF6215000-memory.dmp

Filesize
6.4MB

Download