48a2769f938aa635ac1294bba40ffab3b6191c9159f5c322496bc764aa6b9c76

Analysis

max time kernel
27s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/05/2023, 10:33

Target

SigmaTool.exe
Size

57.4MB
MD5

1e858a23b1654f6572155fb1a5bad9f0
SHA1

a8e461c9004c81c12ced710724a63563529937ae
SHA256

48a2769f938aa635ac1294bba40ffab3b6191c9159f5c322496bc764aa6b9c76
SHA512

de46159d37d7858bbdcff67f8995a554d062fece323908e136f0bcfa9ae21755618670a54c13d44a1cecd6dd583dd570cf6017fae713d672f53a19ccc3b051f4
SSDEEP

1572864:AS1gy6fnJXGMK4XRsbkEgjfBmMKYOESCU/+k3z7F:A4gy+gYRSgjfBmMKySC++k3z7

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1548	SigmaTool.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1548	1612	SigmaTool.exe	28
PID 1612 wrote to memory of 1548	1612	SigmaTool.exe	28
PID 1612 wrote to memory of 1548	1612	SigmaTool.exe	28

C:\Users\Admin\AppData\Local\Temp\SigmaTool.exe
"C:\Users\Admin\AppData\Local\Temp\SigmaTool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\SigmaTool.exe
  "C:\Users\Admin\AppData\Local\Temp\SigmaTool.exe"
  2⤵
  - Loads dropped DLL
  PID:1548

C:\Users\Admin\AppData\Local\Temp\_MEI16122\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI16122\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit