f2a8646758a3303ad17c25f00614a463ae151bfe8f0794eb7c34fbe9da282fd3 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 13:05

Sharing

Report Analysis Logs

General

Target

SoxMenu.exe
Size

5.3MB
MD5

f4bf332ff6d2517cade8256efc9ff992
SHA1

70d0decdf73714be88b2387cceea44c92e1dfdad
SHA256

f2a8646758a3303ad17c25f00614a463ae151bfe8f0794eb7c34fbe9da282fd3
SHA512

a278df9e5601655e031e085644af3b55b695e036bbac6bb3f2991bac627ba6b3efc1e86bf6f1a7ab90db127a25710bf581e8a17d72ec54deece59a45fd925e18
SSDEEP

98304:FX8C3eTCzb71QGQCPDbZfHayCb7BJ5mjwNwwMeZYobSr+ZO7Agigu:FX5cCdQmRfaycBIGpEoA7Agigu

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

SoxMenu.exe

pid process

3028 SoxMenu.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SoxMenu.exe

description	pid	process	target process
PID 2368 wrote to memory of 3028	2368	SoxMenu.exe	SoxMenu.exe
PID 2368 wrote to memory of 3028	2368	SoxMenu.exe	SoxMenu.exe
PID 2368 wrote to memory of 3028	2368	SoxMenu.exe	SoxMenu.exe

C:\Users\Admin\AppData\Local\Temp\SoxMenu.exe
"C:\Users\Admin\AppData\Local\Temp\SoxMenu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Users\Admin\AppData\Local\Temp\SoxMenu.exe
"C:\Users\Admin\AppData\Local\Temp\SoxMenu.exe"
2⤵
- Loads dropped DLL
PID:3028

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI23682\python310.dll
Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit