6b26d8412e6b4a854e3293864ba8220afae9187f6153882df4fba9a776236351 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 07:37

Sharing

Report Analysis Logs

General

Target

UNBAN TOOL.exe
Size

8.2MB
MD5

97778110381424d20652bf10ce2de05b
SHA1

ac55a587889dc1667e40f96533d7715beb1bdad6
SHA256

6b26d8412e6b4a854e3293864ba8220afae9187f6153882df4fba9a776236351
SHA512

570b4be26c26613e76b454c5b78ebb8716e840067e5422af2c5221f4c174c1661c1450ec69b8430c234b047180358768bca98fb965c2f59be226b4427fe66016
SSDEEP

196608:V7Ek++kdidQmRJ8dA6l7aycBIGpEGo6hTOv+QKfJLg:NEkcidQusl29foWOv+9fJc

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2856	UNBAN TOOL.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2856	1288	UNBAN TOOL.exe	28
PID 1288 wrote to memory of 2856	1288	UNBAN TOOL.exe	28
PID 1288 wrote to memory of 2856	1288	UNBAN TOOL.exe	28

C:\Users\Admin\AppData\Local\Temp\UNBAN TOOL.exe
"C:\Users\Admin\AppData\Local\Temp\UNBAN TOOL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\UNBAN TOOL.exe
  "C:\Users\Admin\AppData\Local\Temp\UNBAN TOOL.exe"
  2⤵
  - Loads dropped DLL
  PID:2856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI12882\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit