9abe0ca0b62f85b93c77599e28ad4383972b9b2731735c0d35a1d57c1edf50cc

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
01/07/2023, 05:48

Target

Confidential.exe
Size

6.3MB
MD5

fccbea6f574c7e047b761e3532707dc1
SHA1

ed32c1494e8b4394616e846eb2f5dacb02cb5b40
SHA256

9abe0ca0b62f85b93c77599e28ad4383972b9b2731735c0d35a1d57c1edf50cc
SHA512

c4c55a1603f0f903d7f20b555c9c27c342a0c174ec0a17425e8bc920a0838a082d3918f280dc378c4b6d9e0d6d60a510bd51061592523cfda5a82653e77d5bfe
SSDEEP

196608:yLBtOdQmRJ8dA6lXCy1ArqkVpKCX+PrF4ZIegh0EVZ:+BodQuslXrAZYCuPJOIeg2u

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
376	Confidential.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 376	2028	Confidential.exe	27
PID 2028 wrote to memory of 376	2028	Confidential.exe	27
PID 2028 wrote to memory of 376	2028	Confidential.exe	27

C:\Users\Admin\AppData\Local\Temp\Confidential.exe
"C:\Users\Admin\AppData\Local\Temp\Confidential.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\Confidential.exe
  "C:\Users\Admin\AppData\Local\Temp\Confidential.exe"
  2⤵
  - Loads dropped DLL
  PID:376

C:\Users\Admin\AppData\Local\Temp\_MEI20282\python310.dll

Filesize
4.3MB

MD5
54f8267c6c116d7240f8e8cd3b241cd9

SHA1
907b965b6ce502dad59cde70e486eb28c5517b42

SHA256
c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948

SHA512
f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20282\python310.dll

Filesize
4.3MB

MD5
54f8267c6c116d7240f8e8cd3b241cd9

SHA1
907b965b6ce502dad59cde70e486eb28c5517b42

SHA256
c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948

SHA512
f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1

Download Submit