d50c09b73439c9730f2cb224f900b0de3be7a6b659614fe6569b80d4c68970ad

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 01:33

Target

Sharingan.exe
Size

6.9MB
MD5

a65aa936034e8a4f22832239d5a9d2bc
SHA1

ee4e1b6e79dd23264ef7addfdad8c8de4bd0c8b1
SHA256

67b70fff711534c5281245bf10b002f9d06bca7f3871be17ae50019c0a25db72
SHA512

6b9c8662319b928c96220a820a0d96e2892850d631d18469cec8c9802330600df2cb2bd2475a47129a7075a4940dfe205c89f17645f007b2301e7026a21b554b
SSDEEP

196608:A1mV1JgB6ylnlPzf+JiJCsmFMvNn6hVvTX:lgBRlnlPSa7mmvN+rX

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

Sharingan.exe

pid process

2508 Sharingan.exe

pid	process
2508	Sharingan.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI28562\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Sharingan.exe

description	pid	process	target process
PID 2856 wrote to memory of 2508	2856	Sharingan.exe	Sharingan.exe
PID 2856 wrote to memory of 2508	2856	Sharingan.exe	Sharingan.exe
PID 2856 wrote to memory of 2508	2856	Sharingan.exe	Sharingan.exe

C:\Users\Admin\AppData\Local\Temp\Sharingan.exe
"C:\Users\Admin\AppData\Local\Temp\Sharingan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\Sharingan.exe
  "C:\Users\Admin\AppData\Local\Temp\Sharingan.exe"
  2⤵
  - Loads dropped DLL
  PID:2508

C:\Users\Admin\AppData\Local\Temp\_MEI28562\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
memory/2508-28-0x000007FEF5970000-0x000007FEF5F5A000-memory.dmp

Filesize
5.9MB

Download