a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 01:50

Target

a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
Size

6.8MB
MD5

70d39508b4784708006b0adaf50107f6
SHA1

252a28a5d464da4784f1fde14b9a87db601981cf
SHA256

a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58
SHA512

7145748a620d17cd019284f93a6fd8d309902c7d3d61d997e4c5831e9795308228462035df1c6c9d6ceec2656ffac291c81658f708cdaf5c065ab53762af1766
SSDEEP

196608:68V1cF3B6ylnlPzf+JiJCsmFMvcn6hVvn:aBRlnlPSa7mmvc+P

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe

pid process

2588 a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\_MEI17042\python311.dll upx

pid	process
2588	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI17042\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe

description	pid	process	target process
PID 1704 wrote to memory of 2588	1704	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
PID 1704 wrote to memory of 2588	1704	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
PID 1704 wrote to memory of 2588	1704	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe

C:\Users\Admin\AppData\Local\Temp\a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
"C:\Users\Admin\AppData\Local\Temp\a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
"C:\Users\Admin\AppData\Local\Temp\a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe"
2⤵
- Loads dropped DLL
PID:2588

C:\Users\Admin\AppData\Local\Temp\_MEI17042\python311.dll
Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
memory/2588-23-0x000007FEF59C0000-0x000007FEF5FAA000-memory.dmp

Filesize
5.9MB

Download