8dc32044e54f418a9857873945dd35cbaec502c94b5e664c009d23c46a4ad89d

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 17:35

Target

Astri.exe
Size

7.4MB
MD5

be414a6c564dcb09c438847038f00989
SHA1

3d0778795b47ce9328f570d88b6d53adc60b036b
SHA256

8dc32044e54f418a9857873945dd35cbaec502c94b5e664c009d23c46a4ad89d
SHA512

3789bc531d5d9d8d2ea1e435465c52acb0c9effeb6478e781582b2ceaf9920631c0ae73c910eca7319a3176d58dc05e688b63acb54ed2ce1e3ec6107baaa8daa
SSDEEP

196608:eWrBs1YurErvI9pWjgfPvzm6gsFE44frk:DRurEUWjC3zDbF4frk

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2028	Astri.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c3e-21.dat	upx
behavioral1/memory/2028-23-0x000007FEF6BB0000-0x000007FEF71A2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2028	2916	Astri.exe	30
PID 2916 wrote to memory of 2028	2916	Astri.exe	30
PID 2916 wrote to memory of 2028	2916	Astri.exe	30

C:\Users\Admin\AppData\Local\Temp\Astri.exe
"C:\Users\Admin\AppData\Local\Temp\Astri.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\Astri.exe
  "C:\Users\Admin\AppData\Local\Temp\Astri.exe"
  2⤵
  - Loads dropped DLL
  PID:2028

C:\Users\Admin\AppData\Local\Temp\_MEI29162\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2028-23-0x000007FEF6BB0000-0x000007FEF71A2000-memory.dmp

Filesize
5.9MB

Download