aa126abde8bf474ff9d0c8b3c589848d1a352b944ded4828970267d2a0c038bf

Resubmissions

25-11-2023 19:05

25-11-2023 18:58

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
25-11-2023 18:58

Target

genshin_update_mods_41_26_be4c0.exe
Size

6.2MB
MD5

ce5415c477a478f1b60dd1267770030a
SHA1

4fff0863e9ab65d44c91803d43702ab44dee6e3d
SHA256

aa126abde8bf474ff9d0c8b3c589848d1a352b944ded4828970267d2a0c038bf
SHA512

59eb7f2eb43dd25f3cfab1d4a5d5c451623c9c8621b16bf09a4d095630c27c6ef6ac4db3fd32a9113830412c9853ce24d73a97eb45ec081b4501a8f556a56269
SSDEEP

196608:NasQbxbAQnwejuJDUX47dwdW0LBwnCOD:yxnaUX47d4SR

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2772	genshin_update_mods_41_26_be4c0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2772	2732	genshin_update_mods_41_26_be4c0.exe	29
PID 2732 wrote to memory of 2772	2732	genshin_update_mods_41_26_be4c0.exe	29
PID 2732 wrote to memory of 2772	2732	genshin_update_mods_41_26_be4c0.exe	29

C:\Users\Admin\AppData\Local\Temp\genshin_update_mods_41_26_be4c0.exe
"C:\Users\Admin\AppData\Local\Temp\genshin_update_mods_41_26_be4c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\genshin_update_mods_41_26_be4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\genshin_update_mods_41_26_be4c0.exe"
  2⤵
  - Loads dropped DLL
  PID:2772

C:\Users\Admin\AppData\Local\Temp\_MEI27322\python311.dll

Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI27322\python311.dll

Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit