138e58910298ddc75eac776657171d68632475b398fcd0464652c529e6d969b1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 18:52

Target

mainHAZARDOUS.exe
Size

22.4MB
MD5

72ec7d25b5a602c6f978e06234ad52fc
SHA1

1c35b30db8e26a6d391531779d722259ce6463d1
SHA256

138e58910298ddc75eac776657171d68632475b398fcd0464652c529e6d969b1
SHA512

f6915eb95e9c84afda046eba0d12f69a91621bb8a8d80795b0a3664d35cd91b54c5db9920cf5ebc9a49081d89ce9ef94142c1da7cc561c86af0f17061e72a4ef
SSDEEP

393216:g2P+TWB2KGySA6x2o7eWECZ10Kj9kfM2KRvhfyhUFkor/RB3KDp2:FP+D2o7eWEQ0c9cbKRvhqhkko11KN

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2672	mainHAZARDOUS.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000015d81-12.dat	upx
behavioral1/memory/2672-14-0x000007FEF68E0000-0x000007FEF6D46000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2672	3068	mainHAZARDOUS.exe	28
PID 3068 wrote to memory of 2672	3068	mainHAZARDOUS.exe	28
PID 3068 wrote to memory of 2672	3068	mainHAZARDOUS.exe	28

C:\Users\Admin\AppData\Local\Temp\mainHAZARDOUS.exe
"C:\Users\Admin\AppData\Local\Temp\mainHAZARDOUS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\mainHAZARDOUS.exe
  "C:\Users\Admin\AppData\Local\Temp\mainHAZARDOUS.exe"
  2⤵
  - Loads dropped DLL
  PID:2672

C:\Users\Admin\AppData\Local\Temp\_MEI30682\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2672-14-0x000007FEF68E0000-0x000007FEF6D46000-memory.dmp

Filesize
4.4MB

Download