85fca9dc798a46c85e7ccaf37e6ac8a6cb0ab85b2bf43e5d675ed9bae99be647

Resubmissions

max time kernel
842s
max time network
844s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-02-2025 15:01

Target

SpeedHubX.exe
Size

29.9MB
MD5

4bdaae8ae46b695748b9876025e70085
SHA1

aa638886eb62f22e265dcba62b4f33336d705403
SHA256

85fca9dc798a46c85e7ccaf37e6ac8a6cb0ab85b2bf43e5d675ed9bae99be647
SHA512

d89653c8ee93bb7c5e5f3880a19d60cd7d447321f193981fad64de57403e324a30488c85e4e21ec803d4eeedc7952ea9bf71478d3a1d60bacc88732ef57712f9
SSDEEP

786432:kow/lhONW8HlOQl8dPXB6BYeBLM2rCFsSVd:4lhsWUl7lmPxaYeB4jsS

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2092	SpeedHubX.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00030000000209f5-1156.dat	upx
behavioral1/memory/2092-1158-0x000007FEF5C70000-0x000007FEF62D5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2092	2380	SpeedHubX.exe	30
PID 2380 wrote to memory of 2092	2380	SpeedHubX.exe	30
PID 2380 wrote to memory of 2092	2380	SpeedHubX.exe	30

C:\Users\Admin\AppData\Local\Temp\SpeedHubX.exe
"C:\Users\Admin\AppData\Local\Temp\SpeedHubX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\SpeedHubX.exe
  "C:\Users\Admin\AppData\Local\Temp\SpeedHubX.exe"
  2⤵
  - Loads dropped DLL
  PID:2092

C:\Users\Admin\AppData\Local\Temp\_MEI23802\python313.dll

Filesize
1.8MB

MD5
13e0653e90a091bde333f7e652ac6f8b

SHA1
130f3271120487b4aac482af56f4de6673aaaeda

SHA256
a89f9220c5afcb81b9a91f00b3bea9ed21ebd2cbae00785cbc2db264d90c862c

SHA512
ad513df8f9a53cb3a8e5bc430a977c4079e7d7547fce43fe29288988ee458ff2ea922eb979582fe4c276e58cd6ef8d771bf6535170554b82c5d54d87caaf5366

Download Submit
memory/2092-1158-0x000007FEF5C70000-0x000007FEF62D5000-memory.dmp

Filesize
6.4MB

Download