c5792d15b0c5a001d8933ab76b92404c38f4d390540cb079b623a24de4d6abb0

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-02-2025 02:04

Target

BootstrapperNew.exe
Size

10.0MB
MD5

67e73f4417fda65b081f0fa55ac23b14
SHA1

ae1bdb410b97ed3212cf649af364531d7a640a1b
SHA256

c5792d15b0c5a001d8933ab76b92404c38f4d390540cb079b623a24de4d6abb0
SHA512

64f5ba113cd64cf3fa62415ebfe4360e6086c46fed5e4c975c3625bd483e3b7ae35e058841eedabb9e2a123c2b4f75adf288bea6f8c1002af72106a828f74110
SSDEEP

196608:WWO069YASYMYYBKpYDXcbwO/ikbwfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAov:jEHOXcb1inIH20drLYRZjov

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2176	BootstrapperNew.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019617-22.dat	upx
behavioral1/memory/2176-24-0x000007FEF6660000-0x000007FEF6CC4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2176	2364	BootstrapperNew.exe	30
PID 2364 wrote to memory of 2176	2364	BootstrapperNew.exe	30
PID 2364 wrote to memory of 2176	2364	BootstrapperNew.exe	30

C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
  2⤵
  - Loads dropped DLL
  PID:2176

C:\Users\Admin\AppData\Local\Temp\_MEI23642\python313.dll

Filesize
1.8MB

MD5
2a4aad7818d527bbea76e9e81077cc21

SHA1
4db3b39874c01bf3ba1ab8659957bbc28aab1ab2

SHA256
4712a6bb81b862fc292fcd857cef931ca8e4c142e70eaa4fd7a8d0a96aff5e7e

SHA512
d10631b7fc25a8b9cc038514e9db1597cec0580ee34a56ce5cfc5a33e7010b5e1df7f15ec30ebb351356e2b815528fb4161956f26b5bfaf3dce7bc6701b79c68

Download Submit
memory/2176-24-0x000007FEF6660000-0x000007FEF6CC4000-memory.dmp

Filesize
6.4MB

Download