4618cee6f93e99ed609373a987bd74cb416751b9db943c22fc05cf0a0e9ba29c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 16:55

Target

RansomV4-2.exe
Size

6.7MB
MD5

dba66f7c173642c951e48f714a40da71
SHA1

94c1d15f44ce4121009912f4f407c6eab02d2326
SHA256

4618cee6f93e99ed609373a987bd74cb416751b9db943c22fc05cf0a0e9ba29c
SHA512

3b351b2efa9f2b2f31bfbbe7bcaece4663fa61af680ea4c9231a539cf30355a3beb830c4f45f98cb1f790e28f10f616bfe22e2280d4b8a1920e9f83760e6a746
SSDEEP

98304:TW8GAx9XQsjA1h9eT393YigJhH0y3T+q2M51Y7uRlXgVLRuq97TgLKhOCVj2O:TW3U9VjA1HeT39Iig7auDXURuAT74q

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2840	RansomV4-2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2840	2096	RansomV4-2.exe	29
PID 2096 wrote to memory of 2840	2096	RansomV4-2.exe	29
PID 2096 wrote to memory of 2840	2096	RansomV4-2.exe	29

C:\Users\Admin\AppData\Local\Temp\RansomV4-2.exe
"C:\Users\Admin\AppData\Local\Temp\RansomV4-2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\RansomV4-2.exe
  "C:\Users\Admin\AppData\Local\Temp\RansomV4-2.exe"
  2⤵
  - Loads dropped DLL
  PID:2840

C:\Users\Admin\AppData\Local\Temp\_MEI20962\python311.dll

Filesize
5.5MB

MD5
387bb2c1e40bde1517f06b46313766be

SHA1
601f83ef61c7699652dec17edd5a45d6c20786c4

SHA256
0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364

SHA512
521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad

Download Submit