b162f02efbadb2f5d6fd7ec434eb830d6f420aa92a530ed8afc874fb1eef7568

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-09-2022 17:45

Target

doubletrouble.exe
Size

6.9MB
MD5

6d75553fa1aa48cc40d34123382f43fe
SHA1

75909fcdcba065a23b9733b8c13ab10bb0bdb8a6
SHA256

b162f02efbadb2f5d6fd7ec434eb830d6f420aa92a530ed8afc874fb1eef7568
SHA512

4f696881ffa6bd2e4aac58f8e1171121b3bbe82911cc7737d8c49ffbe9192a09c706ca51a618af7be53c7ee5135a06778795e9f265829bb7fb0bab69d804db92
SSDEEP

196608:0YwZPL2Vmd6+D/Wc/f/+SNEBqglXJFf35AP4UC:hIL2Vmd6mOc/eRRdJFuhC

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

doubletrouble.exe

pid process

2004 doubletrouble.exe

pid	process
2004	doubletrouble.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

doubletrouble.exe

description	pid	process	target process
PID 1764 wrote to memory of 2004	1764	doubletrouble.exe	doubletrouble.exe
PID 1764 wrote to memory of 2004	1764	doubletrouble.exe	doubletrouble.exe
PID 1764 wrote to memory of 2004	1764	doubletrouble.exe	doubletrouble.exe

C:\Users\Admin\AppData\Local\Temp\doubletrouble.exe
"C:\Users\Admin\AppData\Local\Temp\doubletrouble.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Users\Admin\AppData\Local\Temp\doubletrouble.exe
"C:\Users\Admin\AppData\Local\Temp\doubletrouble.exe"
2⤵
- Loads dropped DLL
PID:2004

C:\Users\Admin\AppData\Local\Temp\_MEI17642\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17642\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
memory/2004-54-0x0000000000000000-mapping.dmp

Download