2d54f5288fb99eefb5a678fb40f4501d63a5bc0f35ff0395747dc2f7c8f6e043

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22-10-2023 13:10

Target

snake-oil.exe
Size

13.1MB
MD5

74c602cc5b0ae6dff25a373c8f0de906
SHA1

d04958a14a474707658e2ff3d095ced53acc193a
SHA256

2d54f5288fb99eefb5a678fb40f4501d63a5bc0f35ff0395747dc2f7c8f6e043
SHA512

e2bd35c5f8da563505566259647b5e87fd02c5cb97e5a4f2559f39e33a394605c585b28321815b88d81ae0353b3c6104e0501e7385fcac748ab8e10ef28e8d53
SSDEEP

393216:xU9lz21W6x9InEroXCfEqirRRo5tN3ZWu4bT4uT7IrTBM04:mS1HxWErUywvstN3zSTcBM/

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1624	snake-oil.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1624	2120	snake-oil.exe	29
PID 2120 wrote to memory of 1624	2120	snake-oil.exe	29
PID 2120 wrote to memory of 1624	2120	snake-oil.exe	29

C:\Users\Admin\AppData\Local\Temp\snake-oil.exe
"C:\Users\Admin\AppData\Local\Temp\snake-oil.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\snake-oil.exe
  "C:\Users\Admin\AppData\Local\Temp\snake-oil.exe"
  2⤵
  - Loads dropped DLL
  PID:1624

C:\Users\Admin\AppData\Local\Temp\_MEI21202\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI21202\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit