f46d32b7f318804b59c4fd9f41694ff4f8e2af3ed9d6af73904e811088f50fd4

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-02-2025 04:50

Target

New folder (8)/Boostrapper.exe
Size

87.4MB
MD5

328b232d2e73f6bb2c3b4527347e79dd
SHA1

0990cbef0acd7a8d98bd1f1ce69e117640e1c8aa
SHA256

ec6bdb22c9db50ee324c9a551ae60d13a79c05473951e4174646b6e09f491cfc
SHA512

a4758fadfbbe9ae8067921d69d4f78472d03ee0644875e9d7cf75443c516c0ce97311adfde5600126cef8a4c1695c801e201a3e471d3ca86e069715c7b440aa1
SSDEEP

1572864:b2GKlXebWesm/OkiqOv8im2A3+T9E7CliHiYgj+h58sMw5I5e3T9PcJFJZ:bnKRCZsm/OknOv8i36+TXwZ5FQe3TgJ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
520	Boostrapper.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020aa5-1264.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 520	2816	Boostrapper.exe	30
PID 2816 wrote to memory of 520	2816	Boostrapper.exe	30
PID 2816 wrote to memory of 520	2816	Boostrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\New folder (8)\Boostrapper.exe
"C:\Users\Admin\AppData\Local\Temp\New folder (8)\Boostrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\New folder (8)\Boostrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\New folder (8)\Boostrapper.exe"
  2⤵
  - Loads dropped DLL
  PID:520

C:\Users\Admin\AppData\Local\Temp\_MEI28162\python311.dll

Filesize
1.6MB

MD5
8ea69ca2292c3af9cdb46dded91bc837

SHA1
72de7df68b2c336720d1528c34f21ff00ed7a2ce

SHA256
3512c3a7ad74af034f51eba397c0e4716f592861ea3030745e8fd4dc8f9bca49

SHA512
fb317bab11c922dc183d834b770e37e382b9cf3ab1ea95e9bca8d73ed1e23cc9ef2b6aea4a20d4637eba34276c81a6eee54b00cb146f825ef554d81387ae4ddc

Download Submit
memory/520-1266-0x000007FEF6360000-0x000007FEF6949000-memory.dmp

Filesize
5.9MB

Download