805d56b5bf26c9511f2cccb5396fc62953d9404d2fd98c6a5602f1c4e1447861

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 02:43

Target

Scythe_MultiTool_1.1_Kadim.exe
Size

57.4MB
MD5

1df676ac3dac61122c35214de6ad0e75
SHA1

70188ae15ca9cec02189b9d7ee54d1bc524ba3ab
SHA256

805d56b5bf26c9511f2cccb5396fc62953d9404d2fd98c6a5602f1c4e1447861
SHA512

b7a8213c702e9e5a5cb62e1090fabfac8df45cf83f2ca0fcdf9f68acc3ab309b3910a2fcf7b14e4a500cab96a852ac73ae3af2f4969ed0ceab3a21087db367f5
SSDEEP

1572864:yS1gy6fnJXGMK4XR6bkEgjfBmMKYOESCU/+k3z7L:y4gy+gYRwgjfBmMKySC++k3z7

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
412	Scythe_MultiTool_1.1_Kadim.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 412	2976	Scythe_MultiTool_1.1_Kadim.exe	29
PID 2976 wrote to memory of 412	2976	Scythe_MultiTool_1.1_Kadim.exe	29
PID 2976 wrote to memory of 412	2976	Scythe_MultiTool_1.1_Kadim.exe	29

C:\Users\Admin\AppData\Local\Temp\Scythe_MultiTool_1.1_Kadim.exe
"C:\Users\Admin\AppData\Local\Temp\Scythe_MultiTool_1.1_Kadim.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\Scythe_MultiTool_1.1_Kadim.exe
  "C:\Users\Admin\AppData\Local\Temp\Scythe_MultiTool_1.1_Kadim.exe"
  2⤵
  - Loads dropped DLL
  PID:412

C:\Users\Admin\AppData\Local\Temp\_MEI29762\python39.dll

Filesize
321KB

MD5
0d38b702d527a0aa200ab2abb6557395

SHA1
777cbc43778ef606c298dba7c1789a7451504d47

SHA256
ac3ef0a5992f1ab01039f7dc9d1b90ea3df10ee8e7955cb2a8b1f7a5e04b6b4c

SHA512
9d8d0d52bc990c7bc58f7a8e5d958dca17d7ccd8a2c2a77eb507f27863dad9ba898b5fd10d2adc4d57924304e0a2facaa642f3c3223cd0461db2d2ceaaed04d1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29762\python39.dll

Filesize
3.1MB

MD5
2d0ee74af530508dba1722bc0f012100

SHA1
057465fd28357e263828f689eeb55171918f29d8

SHA256
f8104b16c904741c2c445ea6b2a3ee0f32640a2f67e6e2d5b37df24e8125daf5

SHA512
913489e48fc3fc5497f66f7fc38d83b246a32eb34de8c84c7695972e3a3678a067b094ee9d22fd590ecef2f9e0db50a72fab6c9dea358be56c84d232d3f27205

Download Submit