3a5e9191fbcefddfe8633d8d8cc38d3db5001bcec58fef278d57c764be036fed

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 04:34

Target

Mega.nz.Checker.by.Arboff.exe
Size

10.0MB
MD5

0fd5d52134361e0e4e871998aacb175b
SHA1

7ce789c6e6e8dfafec6a30d72015a50e23ff5c34
SHA256

3a5e9191fbcefddfe8633d8d8cc38d3db5001bcec58fef278d57c764be036fed
SHA512

bdcec38cb5dc25d7bd91cf744178b61fae7f56a33008611f52a622f5cd145407254e78a4797e834c88708258b5346642947e32ad3a6516b8823c0dc360f57c8c
SSDEEP

196608:BvdzUjpRz6wdQmRJ8dA6lSuqaycBIGpEogayJUSBzmytDaLt3/kllL2+LU/9+VT:7oVRrdQuslSq9NriDuolL2+ya

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2472	Mega.nz.Checker.by.Arboff.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2472	2968	Mega.nz.Checker.by.Arboff.exe	29
PID 2968 wrote to memory of 2472	2968	Mega.nz.Checker.by.Arboff.exe	29
PID 2968 wrote to memory of 2472	2968	Mega.nz.Checker.by.Arboff.exe	29

C:\Users\Admin\AppData\Local\Temp\Mega.nz.Checker.by.Arboff.exe
"C:\Users\Admin\AppData\Local\Temp\Mega.nz.Checker.by.Arboff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\Mega.nz.Checker.by.Arboff.exe
  "C:\Users\Admin\AppData\Local\Temp\Mega.nz.Checker.by.Arboff.exe"
  2⤵
  - Loads dropped DLL
  PID:2472

C:\Users\Admin\AppData\Local\Temp\_MEI29682\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit