3ab06c1340d3b7ef5d124485b62db7a8b1e684f21f2c5456ac5289f9f25ffd7b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-02-2025 23:33

Target

ZephyrExec.exe
Size

7.6MB
MD5

ab54a57c9a91ef8ad6049cd8b390fdf8
SHA1

7923378ad3acada45164b06eff8fc8901791ce74
SHA256

3ab06c1340d3b7ef5d124485b62db7a8b1e684f21f2c5456ac5289f9f25ffd7b
SHA512

10acb23466d99574b4abc1797170f38fe3c872f5ce604a67413329db400c8dddd2901183b7b1736b59baa648261aa6a3a258d4ce878ad513fd606f4caab0393b
SSDEEP

196608:xWv06AQzgwfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAoJ:jU/IH20drLYRZjoJ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2740	ZephyrExec.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019d2d-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2740	2124	ZephyrExec.exe	30
PID 2124 wrote to memory of 2740	2124	ZephyrExec.exe	30
PID 2124 wrote to memory of 2740	2124	ZephyrExec.exe	30

C:\Users\Admin\AppData\Local\Temp\ZephyrExec.exe
"C:\Users\Admin\AppData\Local\Temp\ZephyrExec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\ZephyrExec.exe
  "C:\Users\Admin\AppData\Local\Temp\ZephyrExec.exe"
  2⤵
  - Loads dropped DLL
  PID:2740

C:\Users\Admin\AppData\Local\Temp\_MEI21242\python313.dll

Filesize
1.8MB

MD5
2a4aad7818d527bbea76e9e81077cc21

SHA1
4db3b39874c01bf3ba1ab8659957bbc28aab1ab2

SHA256
4712a6bb81b862fc292fcd857cef931ca8e4c142e70eaa4fd7a8d0a96aff5e7e

SHA512
d10631b7fc25a8b9cc038514e9db1597cec0580ee34a56ce5cfc5a33e7010b5e1df7f15ec30ebb351356e2b815528fb4161956f26b5bfaf3dce7bc6701b79c68

Download Submit
memory/2740-23-0x000007FEF6290000-0x000007FEF68F4000-memory.dmp

Filesize
6.4MB

Download