6a461cad219e15f5edb255cbdee3202c56adeb9ce1708c65696c8c2c53397819

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 19:21

Target
Karma.exe
Size 84.0MB
Sample240107-x2r1qsdcb2
SHA256 0ef43d9de4af2dc3fd0dae9ca3533fbd97bff13b5c95ba4c8521d13b0b9683aa
MD5 711464a82474c913defec443908e21ed
SHA1 e216b0853a6195acf520a7b5a7b46a1c972b666e
SHA512 f04a7e4158cd78fa61568c0e306c6b72f3617dd147d8b58b99aa02a34a340a7135c8c4ecec714def1eb7712bde01dbbe8825275d5e9c4819d7e818cc8dea0888
SSDEEP 393216:36jAPfF3dNPVLCEDLQzH2ciIrHW4H//o3KdUgK1gXuSA:32AjLCEDLQzkIL7/weU9gXuSA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
676	Karma.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 676	2916	Karma.exe	29
PID 2916 wrote to memory of 676	2916	Karma.exe	29
PID 2916 wrote to memory of 676	2916	Karma.exe	29

C:\Users\Admin\AppData\Local\Temp\Karma.exe
"C:\Users\Admin\AppData\Local\Temp\Karma.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\Karma.exe
  "C:\Users\Admin\AppData\Local\Temp\Karma.exe"
  2⤵
  - Loads dropped DLL
  PID:676

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\python39.dll
Size 4.3MB
SHA256 f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366
MD5 1d5e4c20a20740f38f061bdf48aaca4f
SHA1 de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0
SHA512 9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397
SSDEEP 49152:jtWzzUIxSk/gRBDcHIPEh1sGZxMuXG/nP9CmQNTFd/UQtrEB/DRzLnU4Jj/rDgjv:jEUY/U8SSYZ+txquHzMGxwTe
MD5 SHA1 SHA512 SSDEEP

Submit Download