6894ba7a22c5915ab9bd13a2229f67fda4a7216168d33d285ae8a27a9a6b6f36

Analysis

max time kernel
1561s
max time network
1569s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 13:57

Target

source_prepared.exe
Size

80.2MB
MD5

9a44ca81f1c1124898abbe053a858cc9
SHA1

caa10031776914369f11759971b2a852159ff1ad
SHA256

6894ba7a22c5915ab9bd13a2229f67fda4a7216168d33d285ae8a27a9a6b6f36
SHA512

131208b3be1e24711efae989447c58debd1697410cc62dfee11c6d1b01c388f3120709af68e749f0981dcb107a4deb46fae38e05323a1222f2f77f0685a1c55e
SSDEEP

1572864:WvxZQgl8mSk8IpG7V+VPhqHDE7jblgA7iYgj+h58sMw8W2nId3RR:WvxZxXSkB05awHaeA15wS

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

source_prepared.exe

pid process

3024 source_prepared.exe
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\_MEI24162\python311.dll upx

pid	process
3024	source_prepared.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI24162\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

source_prepared.exe

description	pid	process	target process
PID 2416 wrote to memory of 3024	2416	source_prepared.exe	source_prepared.exe
PID 2416 wrote to memory of 3024	2416	source_prepared.exe	source_prepared.exe
PID 2416 wrote to memory of 3024	2416	source_prepared.exe	source_prepared.exe

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
2⤵
- Loads dropped DLL
PID:3024

C:\Users\Admin\AppData\Local\Temp\_MEI24162\python311.dll
Filesize
1.6MB

MD5
87b5d21226d74f069b5ae8fb74743236

SHA1
153651a542db095d0f9088a97351b90d02b307ac

SHA256
3cac88119657daef7f79844aeb9da79b45c1f3bb2ea3468b0d4ed26067852194

SHA512
788bb26b3f4ce99a2b49eef2742972fe843bdd97d361a6e67237f29376648ea6f874f1f6ba6dd53c74ef51a29e650a02fb99dfc30b5badfa9d2e05491f81d7d6

Download Submit
memory/3024-1262-0x000007FEF5900000-0x000007FEF5EE8000-memory.dmp

Filesize
5.9MB

Download