8fd185a5499d728eef4cd181477b0720a60c8be143ff2628941bb2a5985b1f73

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 06:43

Target

discordpy.exe
Size

67.4MB
MD5

45f47a5c459a61db665e25156806514a
SHA1

d5dc5bb256a63f88c58b2d9fe12b877589be42e9
SHA256

8fd185a5499d728eef4cd181477b0720a60c8be143ff2628941bb2a5985b1f73
SHA512

93470ab27d3d5ce4e90a771639e9df2138bd31155fb71912f45c9541c744186dca6b61769bea1ca12a38d26c4baf2e49f234511928343811b457a9d1a3feba09
SSDEEP

1572864:vZJH0iAFP/V4f6Gj53ikjt4jRq2GqFOPV5aEm2qHWB75i2Afyo+udKj:it/VG6RmtCRlGPr1m2qHO5i2eyT

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1756	discordpy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1756	2160	discordpy.exe	28
PID 2160 wrote to memory of 1756	2160	discordpy.exe	28
PID 2160 wrote to memory of 1756	2160	discordpy.exe	28

C:\Users\Admin\AppData\Local\Temp\discordpy.exe
"C:\Users\Admin\AppData\Local\Temp\discordpy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\discordpy.exe
  "C:\Users\Admin\AppData\Local\Temp\discordpy.exe"
  2⤵
  - Loads dropped DLL
  PID:1756

C:\Users\Admin\AppData\Local\Temp\_MEI21602\python310.dll

Filesize
4.2MB

MD5
384349987b60775d6fc3a6d202c3e1bd

SHA1
701cb80c55f859ad4a31c53aa744a00d61e467e5

SHA256
f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8

SHA512
6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

Download Submit