f34796ba5f124f1eb4b610756a43e8bfc789cf6d78a31c91bdcc132a3d4ecdb8

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 19:07

Target
credit card gen/Proxies/Proxy server.exe
Size 16.3MB
Sample240315-xstszaae89
SHA256 a64b532a456a6c0d441858f914ab5ea127212da92a0478b235f31a150d7b6516
MD5 9fbc120af3371e47975aefbec1ab5616
SHA1 ac6bba360c9435328a53700ff33b887857e7c3d8
SHA512 2e82b382049ffa5f6b3169103403750e9f7a75051399c3adf0c49ebd873fad39d0e08002bd343246974578371cb8a0fe2fa564c59a4c3a027fc923b4b6f86db5
SSDEEP 393216:nLYNEkZgf8GngP8AxYDX1+TtIiFGuvB5IjWqn6eCz1flpX8Wjsu:0NRbGnbX71QtIZS3ILn6eOlCesu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2360	Proxy server.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2360	2968	Proxy server.exe	28
PID 2968 wrote to memory of 2360	2968	Proxy server.exe	28
PID 2968 wrote to memory of 2360	2968	Proxy server.exe	28

C:\Users\Admin\AppData\Local\Temp\credit card gen\Proxies\Proxy server.exe
"C:\Users\Admin\AppData\Local\Temp\credit card gen\Proxies\Proxy server.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\credit card gen\Proxies\Proxy server.exe
  "C:\Users\Admin\AppData\Local\Temp\credit card gen\Proxies\Proxy server.exe"
  2⤵
  - Loads dropped DLL
  PID:2360

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29682\python312.dll
Size 6.7MB
SHA256 789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
MD5 550288a078dffc3430c08da888e70810
SHA1 01b1d31f37fb3fd81d893cc5e4a258e976f5884f
SHA512 7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723
SSDEEP 49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
MD5 SHA1 SHA512 SSDEEP

Submit Download