IR REPORT
UNPACKING A
PYTHON EXECUTABLE
8/12/2025
Prepared For :
ENG : Muhammed badawy
EVENT ID 1: PROCESS CREATION & INITIAL TRIAGE
- Our investigation began with the identification of Event ID 1 (process creation).
The primary executable, process_creation_lab.exe, was executed from the “user's Downloads directory”.
A critical first step involved hashing the file and querying it against VirusTotal.
Host Deep analysis was conducted using
[Link] to extract relevant logs in EVTX format. Subsequently
EvtxECmd parsed these logs into CSV, which were then imported into TimelineExplorer for a
comprehensive timeline reconstruction.
This process provided a full picture of the events, revealing the parent process originated from:
C:\Users\mn402\Downloads\process_creation_lab.exe.
TECHNICAL TIMELINE: UNPACKING AND RUNTIME LIBRARIES
Execution of process_creation_lab.exe triggered a self-extraction phase consistent with a PyInstaller-
packed Python executable. The process unpacked multiple runtime and dependency libraries into a
temporary folder (C:\Users\mn402\AppData\Local\Temp\_MEI91082\).
Library Function
[Link] Compression engine
[Link] C/C++ runtime library
[Link], [Link] GUI framework (Tcl/Tk)
[Link] Python interpreter
[Link] Cryptographic primitives (OpenSSL)
[Link] Visual C++ runtime
This sequence indicates a self-contained Python application, where an executable bundles its dependencies,
unpacks them into a temporary location, and then executes its core logic
ALERT USING SIMPLE RULE IN KIBANA