f11e5330bd4b80aa1a8c670d4b1f478acec4577a6ed25d56285508d5ee515b8c

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 12:14

Target

DevilsLoggerV2/DevilsLoggerV2.exe
Size

18.5MB
MD5

62d1ce3dbb3c3ad5c0e4479b6ebf117f
SHA1

4fa2f4f34e4e54a3f89769605bfd8f58f60daf97
SHA256

e7e3685d03687909f29f2b64cd93573356bd216526738d6331d7d1116986ce65
SHA512

d719584eb0e1188bd38aeab146461873b089e83b706779ad8b99953ce9d6f6451171cb45a4bbb7c0666b30d0ced406123e7b4e0c022a32a2653a12b5d69e49ac
SSDEEP

393216:0xdyJhooqHK8L2Vmd6ml/m3pqc/eO47G99M9BJHGR8J8WtQFgWDigBK:0zyJ+zHlyVmdXKquP+1mQ8QQFgWDigA

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

DevilsLoggerV2.exe

pid process

1056 DevilsLoggerV2.exe

pid	process
1056	DevilsLoggerV2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DevilsLoggerV2.exe

description	pid	process	target process
PID 1200 wrote to memory of 1056	1200	DevilsLoggerV2.exe	DevilsLoggerV2.exe
PID 1200 wrote to memory of 1056	1200	DevilsLoggerV2.exe	DevilsLoggerV2.exe
PID 1200 wrote to memory of 1056	1200	DevilsLoggerV2.exe	DevilsLoggerV2.exe

C:\Users\Admin\AppData\Local\Temp\DevilsLoggerV2\DevilsLoggerV2.exe
"C:\Users\Admin\AppData\Local\Temp\DevilsLoggerV2\DevilsLoggerV2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\DevilsLoggerV2\DevilsLoggerV2.exe
"C:\Users\Admin\AppData\Local\Temp\DevilsLoggerV2\DevilsLoggerV2.exe"
2⤵
- Loads dropped DLL
PID:1056

C:\Users\Admin\AppData\Local\Temp\_MEI12002\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12002\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
memory/1056-55-0x0000000000000000-mapping.dmp

Download
memory/1200-54-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

Filesize
8KB

Download