94237eac80fd2a20880180cab19b94e8760f0d1f06715ff42a6f60aef84f4adf

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-02-2025 02:20

Target

Velocity.exe
Size

7.6MB
MD5

8073f87f61f0625f1ec5ecc24c1c686e
SHA1

e03616dc46fc7c550ac1f6587db7ae72209cc642
SHA256

94237eac80fd2a20880180cab19b94e8760f0d1f06715ff42a6f60aef84f4adf
SHA512

765a854ac6a83d74176006dbb8025ea398400822bfc8a8326a73166351960da8416becfd6aeb02df510db7c1ce0571fe82590604ace99865503c3dff0d338232
SSDEEP

196608:HW606uB+wfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAoF:cB1IH20drLYRZjoF

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2432	Velocity.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016c62-21.dat	upx
behavioral1/memory/2432-23-0x000007FEF5C60000-0x000007FEF62C4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2432	2708	Velocity.exe	30
PID 2708 wrote to memory of 2432	2708	Velocity.exe	30
PID 2708 wrote to memory of 2432	2708	Velocity.exe	30

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\Velocity.exe
  "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
  2⤵
  - Loads dropped DLL
  PID:2432

C:\Users\Admin\AppData\Local\Temp\_MEI27082\python313.dll

Filesize
1.8MB

MD5
2a4aad7818d527bbea76e9e81077cc21

SHA1
4db3b39874c01bf3ba1ab8659957bbc28aab1ab2

SHA256
4712a6bb81b862fc292fcd857cef931ca8e4c142e70eaa4fd7a8d0a96aff5e7e

SHA512
d10631b7fc25a8b9cc038514e9db1597cec0580ee34a56ce5cfc5a33e7010b5e1df7f15ec30ebb351356e2b815528fb4161956f26b5bfaf3dce7bc6701b79c68

Download Submit
memory/2432-23-0x000007FEF5C60000-0x000007FEF62C4000-memory.dmp

Filesize
6.4MB

Download