5b8f11147d88bfde1c03ea32f2e4ba1e77a9e3aa37ff66fdc7602eb9e48769c7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-02-2025 05:10

Target

loader.exe
Size

7.6MB
MD5

f641a5b9b0ac2f79f1458c85060cf08d
SHA1

ae2813fa9919f894b9f0d2cc77c7d6a36ad7080c
SHA256

f60447588e7b48fdb404c0356bb80f4f226eee6cc7075455c5d4b7fe77e1b1cb
SHA512

6c09626cc2651aed9c2ad55fd5d4c0fe35b22d3a960302426dfb0b5d47f79b48db3b9f4162fa46c198c59426363a8d7975e5a426ee3ef4a87499c43f1c9e5306
SSDEEP

196608:GW506gq6evTwfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAoB:MqHgIH20drLYRZjoB

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2336	loader.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019fb9-21.dat	upx
behavioral1/memory/2336-23-0x000007FEF6090000-0x000007FEF66F4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2336	2528	loader.exe	30
PID 2528 wrote to memory of 2336	2528	loader.exe	30
PID 2528 wrote to memory of 2336	2528	loader.exe	30

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Loads dropped DLL
  PID:2336

C:\Users\Admin\AppData\Local\Temp\_MEI25282\python313.dll

Filesize
1.8MB

MD5
2a4aad7818d527bbea76e9e81077cc21

SHA1
4db3b39874c01bf3ba1ab8659957bbc28aab1ab2

SHA256
4712a6bb81b862fc292fcd857cef931ca8e4c142e70eaa4fd7a8d0a96aff5e7e

SHA512
d10631b7fc25a8b9cc038514e9db1597cec0580ee34a56ce5cfc5a33e7010b5e1df7f15ec30ebb351356e2b815528fb4161956f26b5bfaf3dce7bc6701b79c68

Download Submit
memory/2336-23-0x000007FEF6090000-0x000007FEF66F4000-memory.dmp

Filesize
6.4MB

Download