34d10d9f569187e67e9c7d994bfb372ddd4775aa6da7b83189832bf1d2ac72c9

Resubmissions

01-07-2024 13:36

01-07-2024 13:34

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 13:34

Target

source_prepared.exe
Size

80.2MB
MD5

4529ed6390a3ce8f8de34bf1b06ccacd
SHA1

090606efd741cb335bf50a5767b2dfc530804b7c
SHA256

34d10d9f569187e67e9c7d994bfb372ddd4775aa6da7b83189832bf1d2ac72c9
SHA512

15e7f520b66806f73ab71cd7cae91b577a245131319b8a6ced8204edce4de4d1345a0dc9a31d68f9abc041f31946f092b211818a35aa07f44cabb9729580d1f7
SSDEEP

1572864:uvxZQgl8mSk8IpG7V+VPhqHDE7jblgA7iYgj+h58sMw8W2nId3RR:uvxZxXSkB05awHaeA15wS

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

source_prepared.exe

pid process

2620 source_prepared.exe
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\_MEI17762\python311.dll upx

pid	process
2620	source_prepared.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI17762\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

source_prepared.exe

description	pid	process	target process
PID 1776 wrote to memory of 2620	1776	source_prepared.exe	source_prepared.exe
PID 1776 wrote to memory of 2620	1776	source_prepared.exe	source_prepared.exe
PID 1776 wrote to memory of 2620	1776	source_prepared.exe	source_prepared.exe

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
2⤵
- Loads dropped DLL
PID:2620

C:\Users\Admin\AppData\Local\Temp\_MEI17762\python311.dll
Filesize
1.6MB

MD5
87b5d21226d74f069b5ae8fb74743236

SHA1
153651a542db095d0f9088a97351b90d02b307ac

SHA256
3cac88119657daef7f79844aeb9da79b45c1f3bb2ea3468b0d4ed26067852194

SHA512
788bb26b3f4ce99a2b49eef2742972fe843bdd97d361a6e67237f29376648ea6f874f1f6ba6dd53c74ef51a29e650a02fb99dfc30b5badfa9d2e05491f81d7d6

Download Submit
memory/2620-1262-0x000007FEF63B0000-0x000007FEF6998000-memory.dmp

Filesize
5.9MB

Download