1a9dffaf2b0c6b58d68a59c4aacaecfe1188f91576c0c5f016afad7f7d77a6bf

Analysis

max time kernel
41s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-01-2023 16:28

Target

cojepetess.exe
Size

6.8MB
MD5

01d8b8cb2c930230e3e16ccd054cd596
SHA1

8a4eaa5e4b5f64357b89cd673c890a620d849afd
SHA256

1a9dffaf2b0c6b58d68a59c4aacaecfe1188f91576c0c5f016afad7f7d77a6bf
SHA512

66f5d597cffbce0efbb1e9b9265ad20b47c3939032447dcf2ca0c576373d73b0f527790af5909582f9358f0d236af4ffc9cb1ddb23cac94aa15699a985d2fb64
SSDEEP

196608:fOx7QICteEroXxWVfEqlbkkwR7VTEdbaE3E4fN77Xcz:kQInEroXgfEqirRRodWE3E4fR7M

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1256	cojepetess.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1256	1476	cojepetess.exe	28
PID 1476 wrote to memory of 1256	1476	cojepetess.exe	28
PID 1476 wrote to memory of 1256	1476	cojepetess.exe	28

C:\Users\Admin\AppData\Local\Temp\cojepetess.exe
"C:\Users\Admin\AppData\Local\Temp\cojepetess.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\cojepetess.exe
  "C:\Users\Admin\AppData\Local\Temp\cojepetess.exe"
  2⤵
  - Loads dropped DLL
  PID:1256

C:\Users\Admin\AppData\Local\Temp\_MEI14762\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI14762\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit
memory/1256-54-0x0000000000000000-mapping.dmp

Download