8facb9f4dab8c89f24db5de1aee42ee86d80c0423d138c9c3930e4ce314fc73d

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-03-2024 03:22

Target

Jokers_Cleaner_V2.exe
Size

13.7MB
MD5

fb1cf575aa9dcf85592b2956a0b7afb7
SHA1

78df71718173217bff6454df48015e80d3a691e7
SHA256

128b60bd445eec4baa7b602bcc2cc5dee8114e4c53507c2737ce53571583a1b9
SHA512

974d4dbf7f5b5b51be789394df663e96d587341344c6641df49413ae8e6abfa6cba324274177991c4c1472b851aba5d75d2cd703a121134522f114f0ac744a79
SSDEEP

196608:b0Ekv0sKYu/PaQ+DuNtHQpXxCL2Vmd6+DKMTNfwZHYYfovCw/jUJpYIHUtE0v1yn:oEkZQzwpBCL2Vmd6mKMBkGCwwFHQiD

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2452	Jokers_Cleaner_V2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2452	2040	Jokers_Cleaner_V2.exe	28
PID 2040 wrote to memory of 2452	2040	Jokers_Cleaner_V2.exe	28
PID 2040 wrote to memory of 2452	2040	Jokers_Cleaner_V2.exe	28

C:\Users\Admin\AppData\Local\Temp\Jokers_Cleaner_V2.exe
"C:\Users\Admin\AppData\Local\Temp\Jokers_Cleaner_V2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\Jokers_Cleaner_V2.exe
  "C:\Users\Admin\AppData\Local\Temp\Jokers_Cleaner_V2.exe"
  2⤵
  - Loads dropped DLL
  PID:2452

C:\Users\Admin\AppData\Local\Temp\_MEI20402\python310.dll

Filesize
4.2MB

MD5
e9c0fbc99d19eeedad137557f4a0ab21

SHA1
8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf

SHA256
5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5

SHA512
74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b

Download Submit