805d56b5bf26c9511f2cccb5396fc62953d9404d2fd98c6a5602f1c4e1447861

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 02:45

Target

Scythe_MultiTool_1.1_Kadim.exe
Size

57.4MB
MD5

1df676ac3dac61122c35214de6ad0e75
SHA1

70188ae15ca9cec02189b9d7ee54d1bc524ba3ab
SHA256

805d56b5bf26c9511f2cccb5396fc62953d9404d2fd98c6a5602f1c4e1447861
SHA512

b7a8213c702e9e5a5cb62e1090fabfac8df45cf83f2ca0fcdf9f68acc3ab309b3910a2fcf7b14e4a500cab96a852ac73ae3af2f4969ed0ceab3a21087db367f5
SSDEEP

1572864:yS1gy6fnJXGMK4XR6bkEgjfBmMKYOESCU/+k3z7L:y4gy+gYRwgjfBmMKySC++k3z7

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1956	Scythe_MultiTool_1.1_Kadim.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1956	2088	Scythe_MultiTool_1.1_Kadim.exe	29
PID 2088 wrote to memory of 1956	2088	Scythe_MultiTool_1.1_Kadim.exe	29
PID 2088 wrote to memory of 1956	2088	Scythe_MultiTool_1.1_Kadim.exe	29

C:\Users\Admin\AppData\Local\Temp\Scythe_MultiTool_1.1_Kadim.exe
"C:\Users\Admin\AppData\Local\Temp\Scythe_MultiTool_1.1_Kadim.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\Scythe_MultiTool_1.1_Kadim.exe
  "C:\Users\Admin\AppData\Local\Temp\Scythe_MultiTool_1.1_Kadim.exe"
  2⤵
  - Loads dropped DLL
  PID:1956

C:\Users\Admin\AppData\Local\Temp\_MEI20882\python39.dll

Filesize
1.6MB

MD5
5aace5d25aab7a4081303c3d0cf618fe

SHA1
121ed39d91e38a2cbf3b2cb122fbba3519b05dfc

SHA256
b371abedbdf677293aa48d9379c750aed0e725b6b2710eb15160b49f22e5d91f

SHA512
3f2e476a78628a97b58049950eacbb7d62b12139e369c00d8e2708a3182854591db0a9d5ef84f2fd5970cc40a73c1437fa133607076aad0e13ffe43aa5f9b627

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20882\python39.dll

Filesize
62KB

MD5
806940522fef4d2b682b70088e7b36c2

SHA1
ff9d7d42def6373526b63416eaffd7079fe3bbbe

SHA256
0926cb8cb6a509ad7011ac30970a45897c48cf979beba7f9ceb644add87ae9ac

SHA512
975bb7b4ecd25365e1b54798b07386c99b9e0106a3a2106f4df941139e7ad10db9a1bb131f370664968e087adae0838823db73b83d4da6ce679baf762d7dd129

Download Submit