3c784128522e6cfb2259f7923ac63bbd79ab01eee880e30002ab0268184f5c25

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 21:28

Target

ImageLoggerV1.exe
Size

50.0MB
MD5

348fbd2fe73eea9327498e1acc7b10f6
SHA1

e25b182f9cbda753b79ae89ec8e5754bf148cec7
SHA256

3c784128522e6cfb2259f7923ac63bbd79ab01eee880e30002ab0268184f5c25
SHA512

2aae339e5b7c240966732d0dff6283ca650fdecfc9b8bc1e75b6e1cf157900c16963638a0a0e0329f82236fd13a6cd60f34d1fcf2c9d0e4fdf300ff1617aeac9
SSDEEP

1572864:kOdkFpI0YbhY/5kn3lf6AAhQ43r/bmq71:VdMpAYe3lCPrrTma

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

ImageLoggerV1.exe

pid process

3004 ImageLoggerV1.exe
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\_MEI16962\python310.dll upx

pid	process
3004	ImageLoggerV1.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI16962\python310.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ImageLoggerV1.exe

description	pid	process	target process
PID 1696 wrote to memory of 3004	1696	ImageLoggerV1.exe	ImageLoggerV1.exe
PID 1696 wrote to memory of 3004	1696	ImageLoggerV1.exe	ImageLoggerV1.exe
PID 1696 wrote to memory of 3004	1696	ImageLoggerV1.exe	ImageLoggerV1.exe

C:\Users\Admin\AppData\Local\Temp\ImageLoggerV1.exe
"C:\Users\Admin\AppData\Local\Temp\ImageLoggerV1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\ImageLoggerV1.exe
"C:\Users\Admin\AppData\Local\Temp\ImageLoggerV1.exe"
2⤵
- Loads dropped DLL
PID:3004

C:\Users\Admin\AppData\Local\Temp\_MEI16962\python310.dll
Filesize
1.4MB

MD5
ff6d06c64abd4727f2ec68fea68a10ad

SHA1
b0f1310e74825063896c70918669d9294c4caa93

SHA256
4ac1f03412a3e955e9d797e9dac84558fe6e3174d704b06defbc0843e72b87ed

SHA512
901e1fc7b66bd31bc2038bca9e027ff1507803f59181b855aa99c36658875a6718421a476ef7a55b94b32fc6a3792ee6d5dfdcf5e2aa564f2f4d51409f22c3af

Download Submit
memory/3004-726-0x000007FEF5CC0000-0x000007FEF6125000-memory.dmp

Filesize
4.4MB

Download