b11384a3db715c4ed6c9dda48c0a07543f1eddc98031d6329b41269564545e91

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 13:39

Target

source_prepared.exe
Size

80.7MB
MD5

151d7708e147957fb7d0fb4dd9cadd6f
SHA1

60b73ba56f2b502aebd183806c64e40081db4dc0
SHA256

b11384a3db715c4ed6c9dda48c0a07543f1eddc98031d6329b41269564545e91
SHA512

e7c20767ec74791bf6c3edec77c89404e9e72601f74104c7509d0ffdde4bcc446ab654e6278baf3ea89538ce92d5fab6327b4f743d5d88477cf0c5d0a4d63d3e
SSDEEP

1572864:EvxZQglKSk8IpG7V+VPhqYdfCE70lgLiYgj+h58sMwFWuWDxNwJk:EvxZxwSkB05awcfAeF55HM3

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

source_prepared.exe

pid process

2212 source_prepared.exe
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\_MEI27282\python311.dll upx
behavioral1/memory/2212-1262-0x000007FEF5D40000-0x000007FEF6332000-memory.dmp upx

pid	process
2212	source_prepared.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI27282\python311.dll	upx
behavioral1/memory/2212-1262-0x000007FEF5D40000-0x000007FEF6332000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

source_prepared.exe

description	pid	process	target process
PID 2728 wrote to memory of 2212	2728	source_prepared.exe	source_prepared.exe
PID 2728 wrote to memory of 2212	2728	source_prepared.exe	source_prepared.exe
PID 2728 wrote to memory of 2212	2728	source_prepared.exe	source_prepared.exe

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
2⤵
- Loads dropped DLL
PID:2212

C:\Users\Admin\AppData\Local\Temp\_MEI27282\python311.dll
Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/2212-1262-0x000007FEF5D40000-0x000007FEF6332000-memory.dmp

Filesize
5.9MB

Download