3cc956e5975dffcdcc79fdef402ce9881aca83096c234dd779ebc29bdd97eb3f

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 15:51

Target

Rebomb2AYOP/ReBomb2App/ReBomb2App.exe
Size

13.1MB
MD5

8d172fac6ce41d075145a4824d3a562d
SHA1

6799715beaea5a5654aaf3277b3758b825e90622
SHA256

2d52a619c25bee331df6e750ff8029622b6de14ef00b2704935b624f0f12fac5
SHA512

88ecb5fcd939ea507965001a1e560b4dfb054cc35859d9aa5f9cbd8982baca48084ad3f5173164f5ed104cc917021942e5b7bff9c9a6bf852a4dc97a90679c17
SSDEEP

196608:gay33X6t1u+DwGcsAgeEvev58r6/avRMQtcGfcY3gtAIrPCdOiEAH72o:UHWk3meE08r6avSycGfdEWdMAbZ

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2532	ReBomb2App.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2532	2444	ReBomb2App.exe	29
PID 2444 wrote to memory of 2532	2444	ReBomb2App.exe	29
PID 2444 wrote to memory of 2532	2444	ReBomb2App.exe	29

C:\Users\Admin\AppData\Local\Temp\Rebomb2AYOP\ReBomb2App\ReBomb2App.exe
"C:\Users\Admin\AppData\Local\Temp\Rebomb2AYOP\ReBomb2App\ReBomb2App.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\Rebomb2AYOP\ReBomb2App\ReBomb2App.exe
  "C:\Users\Admin\AppData\Local\Temp\Rebomb2AYOP\ReBomb2App\ReBomb2App.exe"
  2⤵
  - Loads dropped DLL
  PID:2532

C:\Users\Admin\AppData\Local\Temp\_MEI24442\python311.dll

Filesize
5.5MB

MD5
58e01abc9c9b5c885635180ed104fe95

SHA1
1c2f7216b125539d63bd111a7aba615c69deb8ba

SHA256
de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837

SHA512
cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

Download Submit