97fab78b42550c369c9447575ea2fd6593c67b66683ca0eb744896dab244911b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 16:16

Target

texturepackminecraft.exe
Size

5.8MB
MD5

2f39c064126b2fbf1ecdb1ac1a3a0888
SHA1

8e1c2b6e09af431d08f90f458e3d9a0431f2ad41
SHA256

97fab78b42550c369c9447575ea2fd6593c67b66683ca0eb744896dab244911b
SHA512

e004c427f3f10b89bcc5b91a5ade5ddbebf107c8ce201c2b784056d5b591682575b99588252a3510fa3be0a39ef1209256fd9d01f50c5d96b420241c8776d6ad
SSDEEP

98304:Xz8V3eHIzb71QGQCPDbZfzuOqV6l7ayCb7BJ5mjwNwwMeZYobSr+8/8dTxCf:XzyawdQmRrdA6l7aycBIGpEoo/aTx

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2996	texturepackminecraft.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2996	1276	texturepackminecraft.exe	29
PID 1276 wrote to memory of 2996	1276	texturepackminecraft.exe	29
PID 1276 wrote to memory of 2996	1276	texturepackminecraft.exe	29

C:\Users\Admin\AppData\Local\Temp\texturepackminecraft.exe
"C:\Users\Admin\AppData\Local\Temp\texturepackminecraft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\texturepackminecraft.exe
  "C:\Users\Admin\AppData\Local\Temp\texturepackminecraft.exe"
  2⤵
  - Loads dropped DLL
  PID:2996

C:\Users\Admin\AppData\Local\Temp\_MEI12762\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit