1bf1d4e0b573715be763a0e0aef6ac8c208bd90e7b5d11b313823b736aa6f69c

Analysis

max time kernel
39s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 15:01

Target
GetTokenDiscord.exe
Size 11.3MB
Sample240608-seaeysdf28
SHA256 1bf1d4e0b573715be763a0e0aef6ac8c208bd90e7b5d11b313823b736aa6f69c
MD5 64968566f324de904c872a915090d0a9
SHA1 7061d737ed10a0a92095b74ca07b236841db74c6
SHA512 4d7f50b60f63ebe750d999b2f8d7aae254924d55622c5a73ad607ad4bcfa6e2a1863aa5385bb628f43d768ed4f20386a997cff13eb370b40af1e4a8f5bd24ce4
SSDEEP 196608:Da6nh+h7mTID0pUzPLhQNQm8NkKen1W903eV4QR5tpDjIIAcwDBRPovckfQziAFH:5+h7WpUTLfhJsW+eGQRz9joBsKJa5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2740	GetTokenDiscord.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2740	3056	GetTokenDiscord.exe	29
PID 3056 wrote to memory of 2740	3056	GetTokenDiscord.exe	29
PID 3056 wrote to memory of 2740	3056	GetTokenDiscord.exe	29

C:\Users\Admin\AppData\Local\Temp\GetTokenDiscord.exe
"C:\Users\Admin\AppData\Local\Temp\GetTokenDiscord.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\GetTokenDiscord.exe
  "C:\Users\Admin\AppData\Local\Temp\GetTokenDiscord.exe"
  2⤵
  - Loads dropped DLL
  PID:2740

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30562\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
MD5 SHA1 SHA512 SSDEEP

Submit Download