73aa62687ed02328cd8720abcf044b4ea77ddd98b004b5b009db15d00dbcc08a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-02-2025 18:31

Target

dependices.exe
Size

21.8MB
MD5

4f2b504074589822459f7f16fa34ff46
SHA1

17c947f8f92ae66b2199adf2f2c889107fc663d0
SHA256

73aa62687ed02328cd8720abcf044b4ea77ddd98b004b5b009db15d00dbcc08a
SHA512

b5e941f5e91587661e6981e5c858a885f127f88a7f6e26faf48110642e648c4fda758e17b13c1f3b789e5433a50c51283faeaaa5f43606cdc6cb76eb9d27c5d1
SSDEEP

393216:GqqPbs3CXIQscNurEUWjV7Ehc1JEnEH4I3Gqm7mZyupH7:qPbzXIQnNdbV7Z1kvZ7mZye7

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2688	dependices.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4bc-96.dat	upx
behavioral1/memory/2688-98-0x000007FEF58F0000-0x000007FEF5FC9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2688	2516	dependices.exe	30
PID 2516 wrote to memory of 2688	2516	dependices.exe	30
PID 2516 wrote to memory of 2688	2516	dependices.exe	30

C:\Users\Admin\AppData\Local\Temp\dependices.exe
"C:\Users\Admin\AppData\Local\Temp\dependices.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\dependices.exe
  "C:\Users\Admin\AppData\Local\Temp\dependices.exe"
  2⤵
  - Loads dropped DLL
  PID:2688

C:\Users\Admin\AppData\Local\Temp\_MEI25162\python312.dll

Filesize
1.8MB

MD5
48c97e14c07441c4ea4f05ce968980bf

SHA1
99493314d837df989092931379a67a435762db20

SHA256
2112128e60119e82f1bb95ceaf336a56c6d6f9d41bc5240b66a0e47e9ad1fbc0

SHA512
b5f01d76a1a0e822fafed61d363f976618c4b0f83fe08874b4cf733b5b9df67b06f55dcae406c2ac221dc0609abac4ea9e67c1ac6480c994809a3aaff0cc5116

Download Submit
memory/2688-98-0x000007FEF58F0000-0x000007FEF5FC9000-memory.dmp

Filesize
6.8MB

Download