a9272268e017eced810788b465dd4ce90e4b58e9500a84b382956146b3ff07d3

Resubmissions

04/04/2024, 02:13

04/04/2024, 02:10

max time kernel
1s
max time network
3s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 02:10

Target
Remove-EdgeOnly.exe
Size 7.7MB
Sample240404-cl7e9scd25
SHA256 a9272268e017eced810788b465dd4ce90e4b58e9500a84b382956146b3ff07d3
MD5 617d4acc4a59d7b042276eff21c8f637
SHA1 f6558807cb58ade6d024b34f45e8b5680a23dc81
SHA512 e473e0a962deb1630b0824b2578336bbb297b4db0f03a81fc239c88067181d3b2026e12bd4d3aaab0a3057fc98a80780de08a7ada39b96d299d3bf654d38f1fc
SSDEEP 196608:B/8Olb2w9+L0YFqQxA10++MvJHDO6D3U/7F1g:Bplq5L0HQK1HnEzFa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1136	Remove-EdgeOnly.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1136	1568	Remove-EdgeOnly.exe	29
PID 1568 wrote to memory of 1136	1568	Remove-EdgeOnly.exe	29
PID 1568 wrote to memory of 1136	1568	Remove-EdgeOnly.exe	29
PID 1568 wrote to memory of 1136	1568	Remove-EdgeOnly.exe	29

C:\Users\Admin\AppData\Local\Temp\Remove-EdgeOnly.exe
"C:\Users\Admin\AppData\Local\Temp\Remove-EdgeOnly.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Local\Temp\Remove-EdgeOnly.exe
  "C:\Users\Admin\AppData\Local\Temp\Remove-EdgeOnly.exe"
  2⤵
  - Loads dropped DLL
  PID:1136

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15682\python311.dll
Size 4.7MB
SHA256 89b71fca8d164d6e7a98967036212aa1fb28f5554e2a1b1042556c22c514ac16
MD5 9c83364db2337cedb50cefce5772bf28
SHA1 6a65ce4bec369e2e2f6aa19e52ac556ceb3445fc
SHA512 e3608ced277fce1e64a0d371b928a5bfc0e00d93a3f020a56f698b1aa2f18a80fc726a9f7c25b8d8d98a2b95ca49a03a254b3c704c08772abaadee0b01f8aa48
SSDEEP 49152:XK3+mC319wDdOxDc0+ubpslZjLAFbdE9WJasI6bZHd4MNnGP6uQAgmbf4ufgGGlP:coxZs/ibh66lH2MNbuTpbwu6sQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download