7b8c0cdbbef7a4486fd8dfbf0ce163a68ee797418f78a375b716dd64e313e352

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 01:22

Sharing

Target
slinky crack/loader.exe
Size 84.0MB
Sample240616-brrfkatcng
SHA256 4f4f8bfef2fa77ce873a42adab47b4ce0d8150f4c59d09ecc044793c9400dd49
MD5 8849a8881df71b7e3b78d0ead67fc2c2
SHA1 d98e8d03c0bcddf4b3b10aa87908b47212f7d3ef
SHA512 656757398b8f87e2a90a0962f2c9f02447ceb203ce717ca84f438ca7108cf3c10209d71746096246797f9942da3eccafcc1d61a726fcbd6ec900a059caafad20
SSDEEP 393216:sjAPfF3dNPVLCEDLQzH2ciIrHW4H//o3BdUMK1gC9wN:oAjLCEDLQzkIL7/wjUBgC9wN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1780	loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1780	3048	loader.exe	29
PID 3048 wrote to memory of 1780	3048	loader.exe	29
PID 3048 wrote to memory of 1780	3048	loader.exe	29

C:\Users\Admin\AppData\Local\Temp\slinky crack\loader.exe
"C:\Users\Admin\AppData\Local\Temp\slinky crack\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\slinky crack\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\slinky crack\loader.exe"
  2⤵
  - Loads dropped DLL
  PID:1780

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30482\python39.dll
Size 4.3MB
SHA256 f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366
MD5 1d5e4c20a20740f38f061bdf48aaca4f
SHA1 de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0
SHA512 9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397
SSDEEP 49152:jtWzzUIxSk/gRBDcHIPEh1sGZxMuXG/nP9CmQNTFd/UQtrEB/DRzLnU4Jj/rDgjv:jEUY/U8SSYZ+txquHzMGxwTe
MD5 SHA1 SHA512 SSDEEP

Submit Download