8bed44795846f52a3cfd176c34d9865a457805d202a11ae50a3328dcc232416f

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-02-2025 17:53

Target

zoom_64789348756.exe
Size

17.8MB
MD5

3e9f28645b3a47af4e8a3474e1c91db7
SHA1

1d114c51396ae4bdb6284824c6aa6bccb7edcf49
SHA256

8bed44795846f52a3cfd176c34d9865a457805d202a11ae50a3328dcc232416f
SHA512

6ef45af041f83863ba91b8faadde7e4f3a92e7cbbc3e8037f432455108d94ab12874afdea2cae137931f354b4c639a34581c4b69671edf1d0cdc1fd3cb634d7c
SSDEEP

393216:WqPnLFXlrPmQ8DOETgsvfGFLgUWRvE094Gt1xQZq:7PLFXNOQhESXP0bt1j

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2600	zoom_64789348756.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001c852-111.dat	upx
behavioral1/memory/2600-113-0x000007FEF6A30000-0x000007FEF6E9E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2600	2264	zoom_64789348756.exe	29
PID 2264 wrote to memory of 2600	2264	zoom_64789348756.exe	29
PID 2264 wrote to memory of 2600	2264	zoom_64789348756.exe	29

C:\Users\Admin\AppData\Local\Temp\zoom_64789348756.exe
"C:\Users\Admin\AppData\Local\Temp\zoom_64789348756.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\zoom_64789348756.exe
  "C:\Users\Admin\AppData\Local\Temp\zoom_64789348756.exe"
  2⤵
  - Loads dropped DLL
  PID:2600

C:\Users\Admin\AppData\Local\Temp\_MEI22642\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
memory/2600-113-0x000007FEF6A30000-0x000007FEF6E9E000-memory.dmp

Filesize
4.4MB

Download