b69a4fef963a0d91d405a3f2094581ef22bfe0e6aa0c67a10eb560a683f6e606

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:10

Target

ketamine.exe
Size

25.8MB
MD5

7b513480b32c6038e61413461664063c
SHA1

e12e1f035da33f435ac5723e59502f2a0a4345de
SHA256

b69a4fef963a0d91d405a3f2094581ef22bfe0e6aa0c67a10eb560a683f6e606
SHA512

b16c36a2bf5587c8b72ec2ff56e20f3b09d1880d6592ce83f9f7442ce1705f7b553c314f2890a7fc1a47c0d0675d7836602d0600ef2627ade83432d9852d3655
SSDEEP

393216:to9DM45UUDtSJurEUWjagZewBm6bjHTw6:S9N6cYdb9ZewBmUHJ

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

ketamine.exe

pid process

2176 ketamine.exe
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\_MEI19762\python312.dll upx
behavioral1/memory/2176-97-0x000007FEF54C0000-0x000007FEF5B84000-memory.dmp upx

pid	process
2176	ketamine.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI19762\python312.dll	upx
behavioral1/memory/2176-97-0x000007FEF54C0000-0x000007FEF5B84000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ketamine.exe

description	pid	process	target process
PID 1976 wrote to memory of 2176	1976	ketamine.exe	ketamine.exe
PID 1976 wrote to memory of 2176	1976	ketamine.exe	ketamine.exe
PID 1976 wrote to memory of 2176	1976	ketamine.exe	ketamine.exe

C:\Users\Admin\AppData\Local\Temp\ketamine.exe
"C:\Users\Admin\AppData\Local\Temp\ketamine.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Local\Temp\ketamine.exe
"C:\Users\Admin\AppData\Local\Temp\ketamine.exe"
2⤵
- Loads dropped DLL
PID:2176

C:\Users\Admin\AppData\Local\Temp\_MEI19762\python312.dll
Filesize
1.7MB

MD5
18677d48ba556e529b73d6e60afaf812

SHA1
68f93ed1e3425432ac639a8f0911c144f1d4c986

SHA256
8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

SHA512
a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

Download Submit
memory/2176-97-0x000007FEF54C0000-0x000007FEF5B84000-memory.dmp

Filesize
6.8MB

Download