9aba2734ad9d2da3a2fbaee76d1e081a664024ac97ad09e48faef34bbb8854b6

Analysis

max time kernel
130s
max time network
138s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-02-2025 13:04

Target

MYANSWER.exe
Size

87.0MB
MD5

269df89e6a504561e8e5b43db243e8ae
SHA1

9743e7dfecf96f9e00c9f6d6ec0009478e446958
SHA256

9aba2734ad9d2da3a2fbaee76d1e081a664024ac97ad09e48faef34bbb8854b6
SHA512

5f6c7908cdb37c592e03d2b8e09e65d03cc9edbe2e306e5e13d8a0dee0e17bd3f3c2d1f21d5e1f18ecc712f241f04e5720217323ffd6723da6c232ece118820e
SSDEEP

1572864:w2GKlgWjKsm/OkiqOv8im2AzJE7Bbli08iYgj+h58sMwqVkwOB:wnKirsm/OknOv8i3mSw025O+w

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1740	MYANSWER.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020ae4-1264.dat	upx
behavioral1/memory/1740-1266-0x000007FEF6800000-0x000007FEF6DE8000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1740	MYANSWER.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1740	3056	MYANSWER.exe	29
PID 3056 wrote to memory of 1740	3056	MYANSWER.exe	29
PID 3056 wrote to memory of 1740	3056	MYANSWER.exe	29

C:\Users\Admin\AppData\Local\Temp\MYANSWER.exe
"C:\Users\Admin\AppData\Local\Temp\MYANSWER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\MYANSWER.exe
  "C:\Users\Admin\AppData\Local\Temp\MYANSWER.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1740

C:\Users\Admin\AppData\Local\Temp\_MEI30562\python311.dll

Filesize
1.6MB

MD5
87b5d21226d74f069b5ae8fb74743236

SHA1
153651a542db095d0f9088a97351b90d02b307ac

SHA256
3cac88119657daef7f79844aeb9da79b45c1f3bb2ea3468b0d4ed26067852194

SHA512
788bb26b3f4ce99a2b49eef2742972fe843bdd97d361a6e67237f29376648ea6f874f1f6ba6dd53c74ef51a29e650a02fb99dfc30b5badfa9d2e05491f81d7d6

Download Submit
memory/1740-1266-0x000007FEF6800000-0x000007FEF6DE8000-memory.dmp

Filesize
5.9MB

Download
memory/1740-1267-0x000007FEF6800000-0x000007FEF6DE8000-memory.dmp

Filesize
5.9MB

Download