f41530b3fa407d4ad80f76356f939b85d70b0b95858608de8149c0e54331eeca | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 17:51

Sharing

Report Analysis Logs

General

Target

builder.exe
Size

14.3MB
MD5

0ad57b220794fa7ea977c2febf932710
SHA1

fea4a079c63ac9c12efbd7e6e04d19d6cd8819a5
SHA256

f41530b3fa407d4ad80f76356f939b85d70b0b95858608de8149c0e54331eeca
SHA512

d420e8694d7c4209a0beff7927616053258858e04c2eba2000a30ced1721c96741a6b143a7a70edd882380a38608ccd874c376e4ceadcf0d47269fb060784a1b
SSDEEP

393216:ku7L/sQQdQuslSq9RoWOv+9fggR6iM40Fe:kCL0QQdQuSborvSYgor9F

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2540	builder.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2540	816	builder.exe	28
PID 816 wrote to memory of 2540	816	builder.exe	28
PID 816 wrote to memory of 2540	816	builder.exe	28

C:\Users\Admin\AppData\Local\Temp\builder.exe
"C:\Users\Admin\AppData\Local\Temp\builder.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\builder.exe
  "C:\Users\Admin\AppData\Local\Temp\builder.exe"
  2⤵
  - Loads dropped DLL
  PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI8162\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit