1074a06c6a0d809406ed66947a03e15b037b3b635caddecb5bfd489d42e4a943

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 12:16

Target

trigger.exe
Size

65.6MB
MD5

53cd7ecfca3902d7e70703b79a03d125
SHA1

536f9c9eeb100b11744d851aae2aef2ecce4c06f
SHA256

1074a06c6a0d809406ed66947a03e15b037b3b635caddecb5bfd489d42e4a943
SHA512

efe521376b1514003f09504a9d92555f03d9e17e023ffd971f50e35fcfd3191d34c5b9c432c33b2405022ffe324434379784e5e2cef088f7ed18444bd3896702
SSDEEP

1572864:i4QtI/FP/V4f6Gj53ikjt4jRq2GqFOPV5T62qHWB75izWmyMGMWA2PXwZd:1J/t/VG6RmtCRlGPre2qHO5iqOXv2

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1772	trigger.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1772	2988	trigger.exe	29
PID 2988 wrote to memory of 1772	2988	trigger.exe	29
PID 2988 wrote to memory of 1772	2988	trigger.exe	29

C:\Users\Admin\AppData\Local\Temp\trigger.exe
"C:\Users\Admin\AppData\Local\Temp\trigger.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\trigger.exe
  "C:\Users\Admin\AppData\Local\Temp\trigger.exe"
  2⤵
  - Loads dropped DLL
  PID:1772

C:\Users\Admin\AppData\Local\Temp\_MEI29882\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit