a1e9d2a0a36f1cb5b3fd09a3e07335f9987549fca015428369043031e2cc67cc

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 16:13

Target

Unpacked/pppwn/exploit/pppwn_.exe
Size

8.2MB
MD5

4495b20ab591002c3dddbe78ad8039aa
SHA1

4c05606b4caadac43cd87b9edc9618e193b318c1
SHA256

1d97f2c2368e6c727d3bfeab62e256fb5ab1cfa877342b03b7c9b7858b121327
SHA512

466b911df96f83b3995e6205e45056aa612b177c9ee12f039935c61cdec6cafe1b46a49ae3216e1d0fecee214799b79edf61d58222df9c1e088854d52365b4fa
SSDEEP

196608:QavpiZgqLDs2PxBRKb5ZWDl98canLcznPOA+C8OGE3BbbRYl:d8ZZHPx3gZpVYGA9xJRYl

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

pppwn_.exe

pid process

2308 pppwn_.exe

pid	process
2308	pppwn_.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

pppwn_.exe

description	pid	process	target process
PID 2548 wrote to memory of 2308	2548	pppwn_.exe	pppwn_.exe
PID 2548 wrote to memory of 2308	2548	pppwn_.exe	pppwn_.exe
PID 2548 wrote to memory of 2308	2548	pppwn_.exe	pppwn_.exe
PID 2548 wrote to memory of 2308	2548	pppwn_.exe	pppwn_.exe

C:\Users\Admin\AppData\Local\Temp\Unpacked\pppwn\exploit\pppwn_.exe
"C:\Users\Admin\AppData\Local\Temp\Unpacked\pppwn\exploit\pppwn_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Users\Admin\AppData\Local\Temp\Unpacked\pppwn\exploit\pppwn_.exe
"C:\Users\Admin\AppData\Local\Temp\Unpacked\pppwn\exploit\pppwn_.exe"
2⤵
- Loads dropped DLL
PID:2308

C:\Users\Admin\AppData\Local\Temp\_MEI25482\python311.dll
Filesize
4.7MB

MD5
68193b0ed6bb05e7bf70e380852a4e58

SHA1
842c0346cfbc140988f00c91b575f9b81de94b26

SHA256
d08c8e21a93e60c13ebe30a805f0276e0c8950e4a8af76e6271f1e7264440110

SHA512
f15bbbad656b67e3ece46c9fd624e360471c96cadc636b098b85eb7b37d3d0b06ec774dc843262bcdb3524f4d6bd2659965219dc35c156cd7f60e2f48388b441

Download Submit