d4f72966550109f0fa2a139e26b9ea21c4ec776911ade96a3552104f7cf2f926

Analysis

max time kernel
1591s
max time network
1594s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06-03-2023 22:43

Target

Remove-Edge.exe
Size

8.5MB
MD5

90cd506989e066e6733006803bf45886
SHA1

0e1da5ae0616ffb3636b78bb71b0412c08ee471e
SHA256

d4f72966550109f0fa2a139e26b9ea21c4ec776911ade96a3552104f7cf2f926
SHA512

5c2afcf55a14602ec640fe0ba5ac5aee4ebb94e891284c3a1b891cdd7dfdd2856fa76299ed055a8fcaf9528a5a61c15e69fc1d822e9a558359b16f1f2c9ba125
SSDEEP

196608:I9oqdQmR5dA6lsuErSEEJwdF6OlvJHDO6YZYPXk0:I9dQ2ls+9JOh8Z8

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

Remove-Edge.exe

pid process

1076 Remove-Edge.exe

pid	process
1076	Remove-Edge.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Remove-Edge.exe

description	pid	process	target process
PID 1052 wrote to memory of 1076	1052	Remove-Edge.exe	Remove-Edge.exe
PID 1052 wrote to memory of 1076	1052	Remove-Edge.exe	Remove-Edge.exe
PID 1052 wrote to memory of 1076	1052	Remove-Edge.exe	Remove-Edge.exe

C:\Users\Admin\AppData\Local\Temp\Remove-Edge.exe
"C:\Users\Admin\AppData\Local\Temp\Remove-Edge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Users\Admin\AppData\Local\Temp\Remove-Edge.exe
"C:\Users\Admin\AppData\Local\Temp\Remove-Edge.exe"
2⤵
- Loads dropped DLL
PID:1076

C:\Users\Admin\AppData\Local\Temp\_MEI10522\python311.dll
Filesize
5.5MB

MD5
a72993488cecd88b3e19487d646f88f6

SHA1
5d359f4121e0be04a483f9ad1d8203ffc958f9a0

SHA256
aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038

SHA512
c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10522\python311.dll
Filesize
5.5MB

MD5
a72993488cecd88b3e19487d646f88f6

SHA1
5d359f4121e0be04a483f9ad1d8203ffc958f9a0

SHA256
aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038

SHA512
c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38

Download Submit