96930d130b4ba009076120a31f70314290241ba2243f6bd5bde14cc6dc170c8a

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 20:08

Target

TeddyPcFiles/Teddy PC (main).exe
Size

15.4MB
MD5

31183e0d16f4c66a59e6989212ade4e0
SHA1

c8ba290a15f9086b55504083c96a4f4391ec22f8
SHA256

1e440b158dc8162de4704d5985c4c15000df2e2b703dfeaec22fbe6bf7a59b73
SHA512

237a70a53ca0f8c9cf51e755355210220fd04d0f621e331eab4530d897edd18de699488907ff01ce2836ad1c22253323b2a5146b511196f9c6e60ea9676c6a55
SSDEEP

196608:Mq9XaO93xXh04A1HeT39IigwIc0/ajaA0W8/LV2ck3FEpXSOq33NUqfEx:8eXh0h1+TtIiFU/MaHW8p2ypfg62Ex

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1800	Teddy PC (main).exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1800	2032	Teddy PC (main).exe	28
PID 2032 wrote to memory of 1800	2032	Teddy PC (main).exe	28
PID 2032 wrote to memory of 1800	2032	Teddy PC (main).exe	28

C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe
"C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe
  "C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe"
  2⤵
  - Loads dropped DLL
  PID:1800

C:\Users\Admin\AppData\Local\Temp\_MEI20322\python311.dll

Filesize
5.5MB

MD5
d06da79bfd21bb355dc3e20e17d3776c

SHA1
610712e77f80d2507ffe85129bfeb1ff72fa38bf

SHA256
2835e0f24fb13ef019608b13817f3acf8735fbc5f786d00501c4a151226bdff1

SHA512
e4dd839c18c95b847b813ffd0ca81823048d9b427e5dcf05f4fbe0d77b8f7c8a4bd1c67c106402cd1975bc20a8ec1406a38ad4764ab466ef03cb7eb1f431c38a

Download Submit