18c766006964ed44aa9c82605660ee0c3eefcb577c5a5512b4e040a4e4aadf60

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 14:26

Target

Waltuhium.exe
Size

10.6MB
MD5

8200d020a6b7854f5ca4c0548b86b093
SHA1

24c120c5f6e7c42c9541258e4add0e959a3c4f8c
SHA256

18c766006964ed44aa9c82605660ee0c3eefcb577c5a5512b4e040a4e4aadf60
SHA512

3a6ced1bd514248d70026df5398d1ed71f4789c46432bed54658ff1a568da1a2512b92a8538088aadcaba262d654b27de15307c7ecd9d45b5861b2ae39f045d1
SSDEEP

196608:VcfVU3b01Kpn3V+uq+VvpSdQmRJ8dA6lRuVaycBIGpEGo6hTOv+QKfucQ8/6QjO:FL01+l+uq+VvUdQuslRl9foWOv+9fu6/

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2632	Waltuhium.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2632	1912	Waltuhium.exe	28
PID 1912 wrote to memory of 2632	1912	Waltuhium.exe	28
PID 1912 wrote to memory of 2632	1912	Waltuhium.exe	28

C:\Users\Admin\AppData\Local\Temp\Waltuhium.exe
"C:\Users\Admin\AppData\Local\Temp\Waltuhium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\Waltuhium.exe
  "C:\Users\Admin\AppData\Local\Temp\Waltuhium.exe"
  2⤵
  - Loads dropped DLL
  PID:2632

C:\Users\Admin\AppData\Local\Temp\_MEI19122\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit