e9bf19c453137ac594f19fc208cd25db49831c63f40d5818a3f01f451cbe6a14

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 21:49

Target

source_prepared.exe
Size

76.7MB
MD5

a81fca6de5462d0ffb70eb6f7d963d83
SHA1

a4f153c02a967d8ed2dea3facfe8929908fef0ad
SHA256

e9bf19c453137ac594f19fc208cd25db49831c63f40d5818a3f01f451cbe6a14
SHA512

428fe696a1f9379be38806f070aabd4010121cfaf845492cc190070bea74be33304fda7d76a49dc727fe16d04fc38ab5709077f37c01d9065fda22e768c2fd61
SSDEEP

1572864:kvHcRl9WSk8IpG7V+VPhqb+TTE73lHt7fETiYweyJulZUdg1I6MWhfBcmDta9:kvHcRySkB05awb+TMdeMpuJvMg1ta9

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

source_prepared.exe

pid process

2612 source_prepared.exe
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\_MEI18002\python312.dll upx

pid	process
2612	source_prepared.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI18002\python312.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

source_prepared.exe

description	pid	process	target process
PID 1800 wrote to memory of 2612	1800	source_prepared.exe	source_prepared.exe
PID 1800 wrote to memory of 2612	1800	source_prepared.exe	source_prepared.exe
PID 1800 wrote to memory of 2612	1800	source_prepared.exe	source_prepared.exe

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
2⤵
- Loads dropped DLL
PID:2612

C:\Users\Admin\AppData\Local\Temp\_MEI18002\python312.dll
Filesize
1.7MB

MD5
f23aa992b8e0a301ec8f473d6b784f4b

SHA1
ee73a5da238341cb21a781a3ddcb187d1f971680

SHA256
0ddfba7779ebc44f2fa819a78b54bc730a5543274986e973beee024fab0ecfc6

SHA512
028abb66298fee6173d34f80940f5bdd3988a8373234f32a780ae93e155d90af191d85164077d9b76dc3651bda4d9902ccbfd03d37be3e9662006b65c3defb35

Download Submit
memory/2612-1254-0x000007FEF5AE0000-0x000007FEF61B0000-memory.dmp

Filesize
6.8MB

Download