54688d6636962043c25c84278eddc01863a5a2d43a57e00e1b33d519ad2924c6

Analysis

max time kernel
16s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-02-2025 19:20

Target

source_prepared.exe
Size

83.1MB
MD5

814dc1bea8267c6ae801342770484b0f
SHA1

677b96f1d6b95d7ce8043f22e1fa17a07c0f5729
SHA256

54688d6636962043c25c84278eddc01863a5a2d43a57e00e1b33d519ad2924c6
SHA512

1821be5eb0d44b90ae899fadf3f1243573a396b986a5495b183ca2fe7b1523dc7eeaaf6c94f1756b42fd5204e8453c5db6ae6232877d05d796c98b57a6b75c1b
SSDEEP

1572864:xVjlVWU6eFm7OkiqOv8im2ARxE71lhpBB8iYweyJulZUdgP7mNhDzcv7ZH1O3:jb0eFm7OknOv8i3KGLpnNpur7ihnOrO3

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
832	source_prepared.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020aa9-1268.dat	upx
behavioral1/memory/832-1270-0x000007FEF6120000-0x000007FEF67E5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 832	2388	source_prepared.exe	29
PID 2388 wrote to memory of 832	2388	source_prepared.exe	29
PID 2388 wrote to memory of 832	2388	source_prepared.exe	29

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:832

C:\Users\Admin\AppData\Local\Temp\_MEI23882\python312.dll

Filesize
1.7MB

MD5
71070618402c15a2fad5ca70c9ef7297

SHA1
34fedbf17a57010c5cd20ef4e690616859cc8e68

SHA256
7d35a191edb95ccd85ef05d645deeca3ed1febd9acd659569fab56ae06c1ebdf

SHA512
81ef8749f5c3dbd586ddbbcf26cd6c80607a5cc9c26e31c912f454ca56013082174e2012a507739ec1e9c5a2f019bf0ca6bd3ce18880abdbff0ba5f8f3cbbf28

Download Submit
memory/832-1270-0x000007FEF6120000-0x000007FEF67E5000-memory.dmp

Filesize
6.8MB

Download