403ba6f0a162a231f17f3f9b056c78a6b00d70cf39b8f1b618168b3362420870

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd04012af960734823668b2ed9e7d5df.exe
Size

85.5MB
MD5

cd04012af960734823668b2ed9e7d5df
SHA1

5c18fd575f10023ef8f7d8f78975a8fb439da7e7
SHA256

403ba6f0a162a231f17f3f9b056c78a6b00d70cf39b8f1b618168b3362420870
SHA512

1c8fa5cc2511f697ec24e804988ac8950a273cf66d24e511119894fc5b0b832511db4450fe85345efeabfdee4627187dc5cfa0f945ce0f7334b5080e9b05c1c1
SSDEEP

1572864:ZYvNBYQglewBySk8IpG7V+VPhqAFtgWUUtgW7lgvtpPRQvljSvOul/JGZGHkVsW5:uvNBYxkaySkB05awAkWUhW7e1p2wOuNv

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 7 IoCs

Processes:

cd04012af960734823668b2ed9e7d5df.exe

pid	process
2628	cd04012af960734823668b2ed9e7d5df.exe
2628	cd04012af960734823668b2ed9e7d5df.exe
2628	cd04012af960734823668b2ed9e7d5df.exe
2628	cd04012af960734823668b2ed9e7d5df.exe
2628	cd04012af960734823668b2ed9e7d5df.exe
2628	cd04012af960734823668b2ed9e7d5df.exe
2628	cd04012af960734823668b2ed9e7d5df.exe

UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\_MEI20442\python311.dll upx
behavioral1/memory/2628-1319-0x000007FEF6020000-0x000007FEF6609000-memory.dmp upx

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI20442\python311.dll	upx
behavioral1/memory/2628-1319-0x000007FEF6020000-0x000007FEF6609000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cd04012af960734823668b2ed9e7d5df.exe

description	pid	process	target process
PID 2044 wrote to memory of 2628	2044	cd04012af960734823668b2ed9e7d5df.exe	cd04012af960734823668b2ed9e7d5df.exe
PID 2044 wrote to memory of 2628	2044	cd04012af960734823668b2ed9e7d5df.exe	cd04012af960734823668b2ed9e7d5df.exe
PID 2044 wrote to memory of 2628	2044	cd04012af960734823668b2ed9e7d5df.exe	cd04012af960734823668b2ed9e7d5df.exe

C:\Users\Admin\AppData\Local\Temp\cd04012af960734823668b2ed9e7d5df.exe
"C:\Users\Admin\AppData\Local\Temp\cd04012af960734823668b2ed9e7d5df.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\cd04012af960734823668b2ed9e7d5df.exe
"C:\Users\Admin\AppData\Local\Temp\cd04012af960734823668b2ed9e7d5df.exe"
2⤵
- Loads dropped DLL
PID:2628

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20442\api-ms-win-core-file-l1-2-0.dll
Filesize
21KB

MD5
3473bc217562594b5b126d7aeb9380e9

SHA1
b551b9d9aa80be070f577376e484610e01c5171a

SHA256
0d8190fd619feb20df123931108d499132f7051f1ebb0ef246082f4c52c88b22

SHA512
036b93457ade632ad68264d81ff26ee1156038e234c606882386d6babcbe722a18e9ced1655f97caecaf5fd514e261dafe999a3e9fec00cc677e177f0bf8e203

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20442\api-ms-win-core-file-l2-1-0.dll
Filesize
20KB

MD5
50abf0a7ee67f00f247bada185a7661c

SHA1
0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

SHA256
f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

SHA512
c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20442\api-ms-win-core-localization-l1-2-0.dll
Filesize
21KB

MD5
0414909b279ea61ca344edbe8e33e40b

SHA1
4ece0dabe954c43f9bd5032de76ec29c47b22e10

SHA256
05b0c773a77850f3d50ddb4b82cc4d5f19316fe1aaa65e21b4709ae73f60a28e

SHA512
edbd33540cd1ef69f2ce824cfb991903ec6e4edda815f07d610247594ceeb2ebc78f05a44b4de8c5c937191b7e8b2ef221423c06df303d73deea721c25d15eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20442\api-ms-win-core-processthreads-l1-1-1.dll
Filesize
21KB

MD5
b1ba47d8389c40c2dda3c56cbed14fc5

SHA1
2eef9ffa32171d53affa44e3db7727aa383f7fac

SHA256
c7277c05dc6b905fad5cb930b0ecfbbc4676b46974b4571e54ca44cb6f6be404

SHA512
466e31f17f73bda5149343b23f4966502a8597d2a2e43f9a6c9c32387451d92c6b658ccaae27044e68e4a9fd0ef9c89e32dc7639d59fcf04c596b6abfa09658b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20442\api-ms-win-core-timezone-l1-1-0.dll
Filesize
21KB

MD5
953c63ef10ec30ef7c89a6f0f7074041

SHA1
4b4f1ff3085fded9dbd737f273585ad43175b0a3

SHA256
c93954167c12e15b58ac95240d2e0a2fbd94561d739d9f6aca906d9c30453496

SHA512
b4534785e4d02ad387e3c6082884d438cc4b3cd8758aabcf99620052f5842dbd298351bc1723c274d4f7d3fce0cc940df3d47865fece2f07cdb1151376ba852e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20442\python311.dll
Filesize
1.6MB

MD5
5f6fd64ec2d7d73ae49c34dd12cedb23

SHA1
c6e0385a868f3153a6e8879527749db52dce4125

SHA256
ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

SHA512
c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20442\ucrtbase.dll
Filesize
1.1MB

MD5
3b337c2d41069b0a1e43e30f891c3813

SHA1
ebee2827b5cb153cbbb51c9718da1549fa80fc5c

SHA256
c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

SHA512
fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

Download Submit
memory/2628-1319-0x000007FEF6020000-0x000007FEF6609000-memory.dmp

Filesize
5.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads