aad914f9771ad33a204c7da7407332030dbcdfc9cc594c45d1ec6fa9ad8a8821

Analysis

max time kernel
10s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 17:02

Target

MultiToolV4_1.exe
Size

18.7MB
MD5

774f368973df3fc9cb100cf782075654
SHA1

a2f07bde8570b9dd357deba71d69e8e92fa2e83e
SHA256

aad914f9771ad33a204c7da7407332030dbcdfc9cc594c45d1ec6fa9ad8a8821
SHA512

4be72c3207b413c647fdac9f31d558bc487ae43b6d54815fbcc00af82955ae18b6f7d3c4713a6878b01ffe915b76efca7e2548a1df21df3018de47ebd532e7f4
SSDEEP

393216:DBUu1obI/fL2Vmd6ml/m3p2VBkqEq3+d9fWBJHITJ3W8A02B+WVWhlyH:DWu1h/fyVmdXK23hTOd9f0oV3W8AL9Vb

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1072	MultiToolV4_1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1072	1976	MultiToolV4_1.exe	27
PID 1976 wrote to memory of 1072	1976	MultiToolV4_1.exe	27
PID 1976 wrote to memory of 1072	1976	MultiToolV4_1.exe	27

C:\Users\Admin\AppData\Local\Temp\MultiToolV4_1.exe
"C:\Users\Admin\AppData\Local\Temp\MultiToolV4_1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\MultiToolV4_1.exe
  "C:\Users\Admin\AppData\Local\Temp\MultiToolV4_1.exe"
  2⤵
  - Loads dropped DLL
  PID:1072

C:\Users\Admin\AppData\Local\Temp\_MEI19762\python310.dll

Filesize
4.2MB

MD5
e9c0fbc99d19eeedad137557f4a0ab21

SHA1
8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf

SHA256
5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5

SHA512
74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI19762\python310.dll

Filesize
4.2MB

MD5
e9c0fbc99d19eeedad137557f4a0ab21

SHA1
8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf

SHA256
5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5

SHA512
74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b

Download Submit