94704b3ce0f221d431c2fd1795a615a1060f377c0af575a5c9e427f9a55a162c

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 22:12

Target

tamperv1.0.2.exe
Size

10.7MB
MD5

a202c814e2c05d83fce056d843247366
SHA1

69b10bf0267c0a71981836cb6400a9844263ba25
SHA256

94704b3ce0f221d431c2fd1795a615a1060f377c0af575a5c9e427f9a55a162c
SHA512

ad122a0a567fd35ec270805b08caaae9abeae26029dcffdec21b0e02c8581e6f5a9a5c60e8d9ced29c799315e53bbfb37bfc9158b6acd1e363b4aaebc4726449
SSDEEP

196608:Gslv8Zda4WdQmR8dA6lN48Qnf2ODjMnGydS8dxoUfNOtZH9BmoQNummokDbIg:ZqdcdQJlNwF3MnG38dBlOtZdBmZum5+r

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2420	tamperv1.0.2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2420	2028	tamperv1.0.2.exe	29
PID 2028 wrote to memory of 2420	2028	tamperv1.0.2.exe	29
PID 2028 wrote to memory of 2420	2028	tamperv1.0.2.exe	29

C:\Users\Admin\AppData\Local\Temp\tamperv1.0.2.exe
"C:\Users\Admin\AppData\Local\Temp\tamperv1.0.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\tamperv1.0.2.exe
  "C:\Users\Admin\AppData\Local\Temp\tamperv1.0.2.exe"
  2⤵
  - Loads dropped DLL
  PID:2420

C:\Users\Admin\AppData\Local\Temp\_MEI20282\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit