edc42e1855dd8e6c704764235e401c8e056c83c9682753fd1f37f0807284dece | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 13:32

Sharing

Report Analysis Logs

General

Target

fn_cheat.exe
Size

20.2MB
MD5

0b7799afd8e9f9e4ccefb1a7b20ddd63
SHA1

551f5117d59658e333a2329c37a41d6008511709
SHA256

edc42e1855dd8e6c704764235e401c8e056c83c9682753fd1f37f0807284dece
SHA512

ed978fc413955d3acfb70fc8297676beab0c06642a82aba68632cb79a3585ecb74b6897b49fb45d3e107af92258e2973c7f60e965fdabd11a8bf29cc03bc074a
SSDEEP

393216:pEkZQtss27GcFG8IW+eGQRg93iObIhRS/MLVrqy6oHd85Tv/:phQtsAcFG8IW+e5R49MhR9ZeKy5T

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

fn_cheat.exe

pid process

2552 fn_cheat.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fn_cheat.exe

description	pid	process	target process
PID 308 wrote to memory of 2552	308	fn_cheat.exe	fn_cheat.exe
PID 308 wrote to memory of 2552	308	fn_cheat.exe	fn_cheat.exe
PID 308 wrote to memory of 2552	308	fn_cheat.exe	fn_cheat.exe

C:\Users\Admin\AppData\Local\Temp\fn_cheat.exe
"C:\Users\Admin\AppData\Local\Temp\fn_cheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:308

C:\Users\Admin\AppData\Local\Temp\fn_cheat.exe
"C:\Users\Admin\AppData\Local\Temp\fn_cheat.exe"
2⤵
- Loads dropped DLL
PID:2552

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI3082\python311.dll
Filesize
5.5MB

MD5
65e381a0b1bc05f71c139b0c7a5b8eb2

SHA1
7c4a3adf21ebcee5405288fc81fc4be75019d472

SHA256
53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a

SHA512
4db465ef927dfb019ab6faec3a3538b0c3a8693ea3c2148fd16163bf31c03c899dfdf350c31457edf64e671e3cc3e46851f32f0f84b267535bebc4768ef53d39

Download Submit