95976390f84c36983964665b810433b3016e421d221a4c83cb49dc98b5ca8a99

Resubmissions

27/03/2025, 18:13

27/03/2025, 16:39

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/03/2025, 16:39

Target

KEYSERC14CK1.2.1byvujr.exe
Size

28.9MB
MD5

c9ca42eddbb644e6bb0f0ae75644550f
SHA1

9d1e6197e0803c5e7ae5943635b8bcb3d0bf1e0e
SHA256

95976390f84c36983964665b810433b3016e421d221a4c83cb49dc98b5ca8a99
SHA512

a4e1d993d7fcfc31086dc12dc2f69ad2401eed669a0a638d3ef9c5aae13b719569afbdf9763dd75d53a818288d3161b4d80dac9ec3784dbdd847980fc8f87de4
SSDEEP

786432:muqJow/lOW8ZwfX8O8l8dPXAbjlsoxCXF1R7Zn:muelOWQwP83lmPwjlsOC7RR

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2940	KEYSERC14CK1.2.1byvujr.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00030000000209da-1114.dat	upx
behavioral1/memory/2940-1116-0x000007FEF5EF0000-0x000007FEF6554000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2940	1868	KEYSERC14CK1.2.1byvujr.exe	31
PID 1868 wrote to memory of 2940	1868	KEYSERC14CK1.2.1byvujr.exe	31
PID 1868 wrote to memory of 2940	1868	KEYSERC14CK1.2.1byvujr.exe	31

C:\Users\Admin\AppData\Local\Temp\KEYSERC14CK1.2.1byvujr.exe
"C:\Users\Admin\AppData\Local\Temp\KEYSERC14CK1.2.1byvujr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\Temp\KEYSERC14CK1.2.1byvujr.exe
  "C:\Users\Admin\AppData\Local\Temp\KEYSERC14CK1.2.1byvujr.exe"
  2⤵
  - Loads dropped DLL
  PID:2940

C:\Users\Admin\AppData\Local\Temp\_MEI18682\python313.dll

Filesize
1.8MB

MD5
6b3a16dc31065257b7845d9ff611e3c6

SHA1
8cf971ee772193a93e49f4701f817bc6245cf81c

SHA256
3cdc6a436aa16671deb975af8290654a134bb916299677a08438fc7e91e6f7e6

SHA512
1d219471032c882b2e624ec1df951f6a59ee8ba39459d8eb917aaeec6899d0af6782580a5dc43ed1bbe852587c52bea32ba93ea195940335e2a19cc120c53aec

Download Submit
memory/2940-1116-0x000007FEF5EF0000-0x000007FEF6554000-memory.dmp

Filesize
6.4MB

Download