0694e3fb51d1dca937bf9a823f450ea17df5b7795e91523c140a1473e45ae060

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:16

Target

B4LLER.exe
Size

69.2MB
MD5

f23cb0d5adaacd859d094671ee730696
SHA1

f3591463bc4a1466342256c569c51cca7f551c1e
SHA256

f2b3acf743652a70763fbb3cef07ef6d3b44d44bf3e5a4836df73b9609f82a4a
SHA512

55b668d27c9ccc8f875bd6f6be0d3b371fc286e24fd08405801a186b3214cef20ddaeeebbf34238287ef5588b65adcf738dd6ed3f2fe5c85cfad9c537234d1c7
SSDEEP

1572864:Hnfr2pBiS1ril7h9rW1LrKiqm2T17nD0ClE71QOI+ksJ:wiSBM7h9QLfqmY1DuI+ksJ

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2252	B4LLER.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2252	2336	B4LLER.exe	1
PID 2336 wrote to memory of 2252	2336	B4LLER.exe	1
PID 2336 wrote to memory of 2252	2336	B4LLER.exe	1

C:\Users\Admin\AppData\Local\Temp\B4LLER.exe
"C:\Users\Admin\AppData\Local\Temp\B4LLER.exe"
1⤵
- Loads dropped DLL
PID:2252

C:\Users\Admin\AppData\Local\Temp\B4LLER.exe
"C:\Users\Admin\AppData\Local\Temp\B4LLER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Users\Admin\AppData\Local\Temp\_MEI23362\pip-20.2.3.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23362\python39.dll

Filesize
1.1MB

MD5
1c6c401896211f79a3b59894739abc1f

SHA1
a87cb95375edd6bc6e82c49cb42892015f9acf78

SHA256
0dbdf9c8e89724808b8c50c58949dd2ed49d8f7d2a7fef1066a4d25296ae4e95

SHA512
6e923267d5fb1f7a4eb4a1ce7833beafbe5916a38751a7e9040b0c6065b985eb3b7228b4f3d1c6078f4aeae5dfdfe0fe399e64453b7c988f638e21197868b99e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI23362\python39.dll

Filesize
382KB

MD5
744754e72accf320c5440279f6d9319f

SHA1
04d0b9f321d77b09b06b5ce02ba41ea77119be01

SHA256
805fdecc136be1cdbeffbaa2dec504ceef8a49fd5b8b0882083330d58e98bd42

SHA512
ecc459d1219fbd53facd20b49f7bd11061fa8e434cdad3143ddbe3b4e9e799286977f2654c37c7edbe0d4b0f4374a0373280bbc293de9a06932a158fc18c10f3

Download Submit