720818fdb9cae600223d72474859f367b66a5a3cdfa6dc1d80ad53c8e6200e62 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 01:39

Sharing

Report Analysis Logs

General

Target

n8zZxpL.exe
Size

8.3MB
MD5

8a03f3cd5136dad910a9c7c50c911822
SHA1

c61816536af80b882e9d2a7a6a0a3c99457124d8
SHA256

720818fdb9cae600223d72474859f367b66a5a3cdfa6dc1d80ad53c8e6200e62
SHA512

121a62b5ba8dcab071f74abe98c2f87c9af67e6e2224c6d76bebf31b141700b215964a6157efd99f461f109b25bb02ffa574e9a01b502074eadd9e6163d428c5
SSDEEP

196608:Ls0jLqBA1HeT39IigQdeE9TFa0Z8DOjCdyl5okknz8Qdd5x9K:l6q1+TtIiLUY9Z8D8Ccl+loWx9K

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

n8zZxpL.exe

pid process

2596 n8zZxpL.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

n8zZxpL.exe

description	pid	process	target process
PID 2456 wrote to memory of 2596	2456	n8zZxpL.exe	n8zZxpL.exe
PID 2456 wrote to memory of 2596	2456	n8zZxpL.exe	n8zZxpL.exe
PID 2456 wrote to memory of 2596	2456	n8zZxpL.exe	n8zZxpL.exe

C:\Users\Admin\AppData\Local\Temp\n8zZxpL.exe
"C:\Users\Admin\AppData\Local\Temp\n8zZxpL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\n8zZxpL.exe
  "C:\Users\Admin\AppData\Local\Temp\n8zZxpL.exe"
  2⤵
  - Loads dropped DLL
  PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI24562\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit