a2f0872e869d0f137638a7d6b4b6c0600ca05cb59849d92c5d8f55863bc8331f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/03/2025, 20:16

Target

rattatouille.exe
Size

24.3MB
MD5

7d7ace536cb81843f7fe3cb9dfb0dcc2
SHA1

a839847e9f9efb83f4842133a4d6b5d9e8ebafe9
SHA256

a2f0872e869d0f137638a7d6b4b6c0600ca05cb59849d92c5d8f55863bc8331f
SHA512

879acabe659fa960dc1759ce82d604fce4d105033c1286493a533b68ca8918b2f6db50878e8fff32a8d226080440985bdcaa3f0bd466fb13e08cc0a1a9519b30
SSDEEP

393216:kV2L62LqCeYwURBjDW8BvS+IHQ7HmBYBzBU4bd+mCEVqFwDLIEVJX3:wowMDW8Vv6BYdBU4d/CzeDL1Vd

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2404	rattatouille.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020966-1096.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2404	3020	rattatouille.exe	30
PID 3020 wrote to memory of 2404	3020	rattatouille.exe	30
PID 3020 wrote to memory of 2404	3020	rattatouille.exe	30

C:\Users\Admin\AppData\Local\Temp\rattatouille.exe
"C:\Users\Admin\AppData\Local\Temp\rattatouille.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\rattatouille.exe
  "C:\Users\Admin\AppData\Local\Temp\rattatouille.exe"
  2⤵
  - Loads dropped DLL
  PID:2404

C:\Users\Admin\AppData\Local\Temp\_MEI30202\python313.dll

Filesize
1.8MB

MD5
9a3d3ae5745a79d276b05a85aea02549

SHA1
a5e60cac2ca606df4f7646d052a9c0ea813e7636

SHA256
09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889

SHA512
46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69

Download Submit
memory/2404-1098-0x000007FEF5B70000-0x000007FEF61D5000-memory.dmp

Filesize
6.4MB

Download