85606ccdbf5c4ca37e5df4dbdf84b2325ed32a8c27e0ead179c9e4ab8e24aff9

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/10/2022, 20:45

Target

lib.exe
Size

10.2MB
MD5

80ae99f3a654ecb00ccb719af1de0415
SHA1

3a5e3522755085bd791cc12939db93f3698221f2
SHA256

a842f0adb1052805250ec08c154f3ec852a44e27268bb8bdd6b00efa50f8f5a6
SHA512

97e404252ab00056694fe7e339680831ca85603d51ce7953bad40e485ce84be516726d01f28582af57bb9a146fec5a289ba124ecf97774f760b4a74c3e1a9a72
SSDEEP

196608:YJT7BAomdL2Vmd6+D5nNgwQ+dtLI/1q3+dgSh7kh0c0W8/LaJmqU0AehRe7e4tI:28dL2Vmd6mFNjyq3+d9h7/LW8OmwgeH

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
604	lib.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 604	1348	lib.exe	27
PID 1348 wrote to memory of 604	1348	lib.exe	27
PID 1348 wrote to memory of 604	1348	lib.exe	27

C:\Users\Admin\AppData\Local\Temp\lib.exe
"C:\Users\Admin\AppData\Local\Temp\lib.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\AppData\Local\Temp\lib.exe
  "C:\Users\Admin\AppData\Local\Temp\lib.exe"
  2⤵
  - Loads dropped DLL
  PID:604

C:\Users\Admin\AppData\Local\Temp\_MEI13482\python310.dll

Filesize
4.2MB

MD5
a1185bef38fdba5e3fe6a71f93a9d142

SHA1
e2b40f5e518ad000002b239a84c153fdc35df4eb

SHA256
8d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e

SHA512
cb9baea9b483b9153efe2f453d6ac0f0846b140e465d07244f651c946900bfcd768a6b4c0c335ecebb45810bf08b7324501ea22b40cc7061b2f2bb98ed7897f4

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI13482\python310.dll

Filesize
4.2MB

MD5
a1185bef38fdba5e3fe6a71f93a9d142

SHA1
e2b40f5e518ad000002b239a84c153fdc35df4eb

SHA256
8d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e

SHA512
cb9baea9b483b9153efe2f453d6ac0f0846b140e465d07244f651c946900bfcd768a6b4c0c335ecebb45810bf08b7324501ea22b40cc7061b2f2bb98ed7897f4

Download Submit