0b53edab42806eef4da3e3a0276ee9c296fc67cc4797ff806ce371e78270c401

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 04:42

Target

wiperpayload.exe
Size

22.7MB
MD5

61118d3cf190d53b95f36272b7512f65
SHA1

5b166d9e5027668ab1f707fe142320292a815523
SHA256

0b53edab42806eef4da3e3a0276ee9c296fc67cc4797ff806ce371e78270c401
SHA512

ecf60cf6aad81cae27427f67019f795c467e2f9dd152a3424f5b98a179e29f089c7a7032b2742454e6ab52a0031a4732a48e667890e090b3e30dc9dc155aa55c
SSDEEP

393216:VvUWv/HL2Vmo2WtYjUaNRDHvcrwhvr+bUn2KekLTH6mp/WViHW0Gzajaq3+d9Xg:RUYyVmVfjrRj0r6+bUno0fcElOd9XgWU

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

wiperpayload.exe

pid process

2644 wiperpayload.exe

pid	process
2644	wiperpayload.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wiperpayload.exe

description	pid	process	target process
PID 2668 wrote to memory of 2644	2668	wiperpayload.exe	wiperpayload.exe
PID 2668 wrote to memory of 2644	2668	wiperpayload.exe	wiperpayload.exe
PID 2668 wrote to memory of 2644	2668	wiperpayload.exe	wiperpayload.exe

C:\Users\Admin\AppData\Local\Temp\wiperpayload.exe
"C:\Users\Admin\AppData\Local\Temp\wiperpayload.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\wiperpayload.exe
  "C:\Users\Admin\AppData\Local\Temp\wiperpayload.exe"
  2⤵
  - Loads dropped DLL
  PID:2644

C:\Users\Admin\AppData\Local\Temp\_MEI26682\python39.dll

Filesize
2.8MB

MD5
432697deb63dd967295a9e56a3beecf4

SHA1
0cf8f82b9ac3d32c31ba75e6e7b8e5dc7d03cf1c

SHA256
f138d2ed7d4e0199287c97d3a4c3c747a68f3af917baaec721e88af781f13c9d

SHA512
68c64baaa741c61bf2887c95dce7027e02be1568712ab5073789efd9d520af99267d6b11a629e1e1f3b132519716f5b6cf7e926b9ab2d064659318b6fe915c6a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI26682\python39.dll

Filesize
4.3MB

MD5
2135da9f78a8ef80850fa582df2c7239

SHA1
aac6ad3054de6566851cae75215bdeda607821c4

SHA256
324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3

SHA512
423b03990d6aa9375ce10e6b62ffdb7e1e2f20a62d248aac822eb9d973ae2bf35deddd2550a4a0e17c51ad9f1e4f86443ca8f94050e0986daa345d30181a2369

Download Submit