ed907caf3875ed80e4a0c47a9150375e7caf3edd8a3641255e565bf6897803cf

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 11:49

Target

minecraft.exe
Size

5.2MB
MD5

8db7cb71f78965dcda25a5844b1eb670
SHA1

53e974c77e960166becde7f01ef7345767d5eca6
SHA256

ed907caf3875ed80e4a0c47a9150375e7caf3edd8a3641255e565bf6897803cf
SHA512

13fa775b0ed5a9d82494b76ccea77af2acaa54de541b8d0e802e301d0bc39b52b1ee257e918215e8eaffe14df48be5a8bded47a51f2f7b9ffdabae115649f984
SSDEEP

98304:Fn+KIDTGpzoLLJ3TbwaVvrZE0I7yoFQK15W8ASLmbNYJERw1jrTHD1D+NBYK:FnlIm9onJ5hrZEnyiU8AdZYJERurT0vY

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

minecraft.exe

pid process

2552 minecraft.exe

pid	process
2552	minecraft.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

minecraft.exe

description	pid	process	target process
PID 2192 wrote to memory of 2552	2192	minecraft.exe	minecraft.exe
PID 2192 wrote to memory of 2552	2192	minecraft.exe	minecraft.exe
PID 2192 wrote to memory of 2552	2192	minecraft.exe	minecraft.exe

C:\Users\Admin\AppData\Local\Temp\minecraft.exe
"C:\Users\Admin\AppData\Local\Temp\minecraft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\minecraft.exe
  "C:\Users\Admin\AppData\Local\Temp\minecraft.exe"
  2⤵
  - Loads dropped DLL
  PID:2552

C:\Users\Admin\AppData\Local\Temp\_MEI21922\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit