08b1f7f575e70eb26e502e940e107aff26c85fedad5f71919ccca855eeaad6a1 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 18:31

Sharing

Report Analysis Logs

General

Target

PageViewFlooder.exe
Size

6.6MB
MD5

f379569c86b6bc411b188d23f5049fb8
SHA1

701a98de87c44c523bca1352f445aaea7ddda1f8
SHA256

08b1f7f575e70eb26e502e940e107aff26c85fedad5f71919ccca855eeaad6a1
SHA512

89fc1245cd2e571ae3b6e0a4854b4469c51c0bdc54f54340bf874f72d01898f4cd0af9f09b3b1cb1cdce167e3abe5f1dffc4c9904f9130c40e9112036b63a7e6
SSDEEP

196608:rYieIs9onJ5hrZERlyiU8AdZYJERurTEtrdCXXoQ3qbPe:Ews9c5hlERJAdZYygro9dCXX

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3044	PageViewFlooder.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3044	1688	PageViewFlooder.exe	29
PID 1688 wrote to memory of 3044	1688	PageViewFlooder.exe	29
PID 1688 wrote to memory of 3044	1688	PageViewFlooder.exe	29

C:\Users\Admin\AppData\Local\Temp\PageViewFlooder.exe
"C:\Users\Admin\AppData\Local\Temp\PageViewFlooder.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\PageViewFlooder.exe
  "C:\Users\Admin\AppData\Local\Temp\PageViewFlooder.exe"
  2⤵
  - Loads dropped DLL
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI16882\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit