40c4fc26947ad84ecbfbeba71c930dc8f7f4dd5ae737c0021a0cdf721a76facf

Analysis

max time kernel
139s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/03/2025, 03:12

Target

EXMservice.exe
Size

21.7MB
MD5

f551d9082d5a86776a906984e9cac3b3
SHA1

7f2294fb608e65fb06b844a559dc3e8ec26dff8b
SHA256

40c4fc26947ad84ecbfbeba71c930dc8f7f4dd5ae737c0021a0cdf721a76facf
SHA512

444f10d6468c28bab1920e33544becbc228b9cca6d710e4751bab50cd04baf6fe2c2d499ed578116212e1219a68f55c6cf836a61dd5f576cce8c6fd3fc1afe1d
SSDEEP

393216:xQKf8nAG+bkX7ViesEfcGhCDNz1FNcRQR35DNJ93IPzIYHEKwPs91DQVtUcpBc:OK0AHbuViP6cGhCDdxDRFXePnkM91DQd

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2804	EXMservice.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000194d7-12.dat	upx
behavioral1/memory/2804-14-0x000007FEF63A0000-0x000007FEF6806000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2804	EXMservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2804	2168	EXMservice.exe	30
PID 2168 wrote to memory of 2804	2168	EXMservice.exe	30
PID 2168 wrote to memory of 2804	2168	EXMservice.exe	30

C:\Users\Admin\AppData\Local\Temp\EXMservice.exe
"C:\Users\Admin\AppData\Local\Temp\EXMservice.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\EXMservice.exe
  "C:\Users\Admin\AppData\Local\Temp\EXMservice.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2804

C:\Users\Admin\AppData\Local\Temp\_MEI21682\python310.dll

Filesize
1.4MB

MD5
72c65de0cc88d6a26d5a7040aaf1fb60

SHA1
68dae332ade43106c72e68a497b6b7df6b314425

SHA256
769f20bcec63eb6567cca095ea59ffcda2c87e2b8600503f0e4f976dfb8da2bb

SHA512
5f658e0bee185613a37f946069ac6723fff93e542a4eb6e3435766c58d09d82894b85502f1686ffc9318bdf4b3a858490866ca56b90238c8c903e794c3a4e3fb

Download Submit
memory/2804-14-0x000007FEF63A0000-0x000007FEF6806000-memory.dmp

Filesize
4.4MB

Download
memory/2804-15-0x000007FEF63A0000-0x000007FEF6806000-memory.dmp

Filesize
4.4MB

Download