Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 02:22
Behavioral task
behavioral1
Sample
6f4c692fd36fda526232e482bc373774.exe
Resource
win7-20240220-en
General
-
Target
6f4c692fd36fda526232e482bc373774.exe
-
Size
7.0MB
-
MD5
6f4c692fd36fda526232e482bc373774
-
SHA1
ab0dff8504e5a3c5df90540a4ffe288f72aa6b6b
-
SHA256
1c71596876a078969816daa32937d1a4b1644c616dd0893519daa95a64410b44
-
SHA512
e1b721237cce6d3d507149e6475464de0d0403f4f00519348f617081d63d414a0f4482f45bd23395e357be20280964c0aaa3e5377a9d08bdfa8a2a86f185a331
-
SSDEEP
98304:RQpDjWM8JEE1rMamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRaYKJJcGhEIFx:RO0deNTfm/pf+xk4dWRatrbWOjgKH
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
6f4c692fd36fda526232e482bc373774.exepid process 2524 6f4c692fd36fda526232e482bc373774.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI20362\python311.dll upx behavioral1/memory/2524-23-0x000007FEF5FB0000-0x000007FEF6598000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6f4c692fd36fda526232e482bc373774.exedescription pid process target process PID 2036 wrote to memory of 2524 2036 6f4c692fd36fda526232e482bc373774.exe 6f4c692fd36fda526232e482bc373774.exe PID 2036 wrote to memory of 2524 2036 6f4c692fd36fda526232e482bc373774.exe 6f4c692fd36fda526232e482bc373774.exe PID 2036 wrote to memory of 2524 2036 6f4c692fd36fda526232e482bc373774.exe 6f4c692fd36fda526232e482bc373774.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f4c692fd36fda526232e482bc373774.exe"C:\Users\Admin\AppData\Local\Temp\6f4c692fd36fda526232e482bc373774.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\6f4c692fd36fda526232e482bc373774.exe"C:\Users\Admin\AppData\Local\Temp\6f4c692fd36fda526232e482bc373774.exe"2⤵
- Loads dropped DLL
PID:2524
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI20362\python311.dllFilesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31
-
memory/2524-23-0x000007FEF5FB0000-0x000007FEF6598000-memory.dmpFilesize
5.9MB