c0ec9be4ba7bf02df9bb47e9be7c24ae8828a31a6e797a2c4bc2653f7ab9a6ce

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 20:34

Target

levo.exe
Size

7.3MB
MD5

b09c05a48e1e44fe220e7ad187128760
SHA1

40b49a7d90e4223e781154d8b9bceb2d240d24c3
SHA256

c0ec9be4ba7bf02df9bb47e9be7c24ae8828a31a6e797a2c4bc2653f7ab9a6ce
SHA512

e1feb6725bd99bbe7e1a09bf963316e0a41356764d2506a71ee023010d5c694fdd107c226d6a4bc4801a6159f9aa71d3bbe6af449f6078cbc46c9a048498f709
SSDEEP

98304:lozHqdVfB2GyuT/9vUIdD9C+z3zO917vOTh+ezsNh75S2zh/hQqzCuivmJ1YPFld:lAQsGbT/9bvLz3S1bA32zOqzYPdT

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2788	levo.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a479-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2788	3048	levo.exe	30
PID 3048 wrote to memory of 2788	3048	levo.exe	30
PID 3048 wrote to memory of 2788	3048	levo.exe	30

C:\Users\Admin\AppData\Local\Temp\levo.exe
"C:\Users\Admin\AppData\Local\Temp\levo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\levo.exe
  "C:\Users\Admin\AppData\Local\Temp\levo.exe"
  2⤵
  - Loads dropped DLL
  PID:2788

C:\Users\Admin\AppData\Local\Temp\_MEI30482\python311.dll

Filesize
1.6MB

MD5
5792adeab1e4414e0129ce7a228eb8b8

SHA1
e9f022e687b6d88d20ee96d9509f82e916b9ee8c

SHA256
7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967

SHA512
c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

Download Submit
memory/2788-24-0x000007FEF59F0000-0x000007FEF5FD9000-memory.dmp

Filesize
5.9MB

Download