27bafcf7e4921815647b80c290338908b9ea395948d9569504e56e554c15b12d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 19:03

Target

Perm_spoofer.exe
Size

7.0MB
MD5

c8c9e646a005116c6efb67c51264226c
SHA1

d165de2840effaf85dcf6699e32cae4e128ce1da
SHA256

27bafcf7e4921815647b80c290338908b9ea395948d9569504e56e554c15b12d
SHA512

50f788f1b3fa21bb62dba446065ec5d574b8df2563d9279cecbafa26d52044de7a040069685d0d63da8ee7f821f304ab164a794ef991d19c26dab84e0186bb5c
SSDEEP

196608:CraBV1QEB6ylnlPzf+JiJCsmFMvNn6hVvT8:wEBRlnlPSa7mmvN+r8

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

Perm_spoofer.exe

pid process

2280 Perm_spoofer.exe
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\_MEI22562\python311.dll upx
behavioral1/memory/2280-23-0x000007FEF5CF0000-0x000007FEF62DA000-memory.dmp upx

pid	process
2280	Perm_spoofer.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI22562\python311.dll	upx
behavioral1/memory/2280-23-0x000007FEF5CF0000-0x000007FEF62DA000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Perm_spoofer.exe

description	pid	process	target process
PID 2256 wrote to memory of 2280	2256	Perm_spoofer.exe	Perm_spoofer.exe
PID 2256 wrote to memory of 2280	2256	Perm_spoofer.exe	Perm_spoofer.exe
PID 2256 wrote to memory of 2280	2256	Perm_spoofer.exe	Perm_spoofer.exe

C:\Users\Admin\AppData\Local\Temp\Perm_spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Perm_spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256

C:\Users\Admin\AppData\Local\Temp\Perm_spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Perm_spoofer.exe"
2⤵
- Loads dropped DLL
PID:2280

C:\Users\Admin\AppData\Local\Temp\_MEI22562\python311.dll
Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
memory/2280-23-0x000007FEF5CF0000-0x000007FEF62DA000-memory.dmp

Filesize
5.9MB

Download