f0e6c4e0b845ce787d792df1ef3f5cfb32e0573d90ca0f712988d77fd90852b5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

code.exe
Size

6.1MB
MD5

0487289101bed35acf24c5dfb42cc3bb
SHA1

be8846efcc061d243f108319e01c7cad577cc6d2
SHA256

f0e6c4e0b845ce787d792df1ef3f5cfb32e0573d90ca0f712988d77fd90852b5
SHA512

a6cd9a7a1accd19c007f16585b8fb29de200988d62651a7ad2eed90b30300da3de8612ed5114fd8c409deb1d4263cf0da3aace61d7842ad2aec1fa6334ae584b
SSDEEP

196608:cwKY6n49x/L2VsLZy7YM30LzajOjMCpHQbu:/+n49x/L2Vu0GzajOjFQb

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2688	code.exe
2688	code.exe
2688	code.exe
2688	code.exe
2688	code.exe
2688	code.exe
2688	code.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2688	2848	code.exe	29
PID 2848 wrote to memory of 2688	2848	code.exe	29
PID 2848 wrote to memory of 2688	2848	code.exe	29

C:\Users\Admin\AppData\Local\Temp\code.exe
"C:\Users\Admin\AppData\Local\Temp\code.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\code.exe
  "C:\Users\Admin\AppData\Local\Temp\code.exe"
  2⤵
  - Loads dropped DLL
  PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI28482\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
6a55a7e284b51b086b63cc6f2061ce8b

SHA1
46a48a1ccf5262038b71ed4be09cf625009d078d

SHA256
d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb

SHA512
6a6ba643bf15581cd579e383bac351ccae714d50453cff52cac7dcf5bd472a170e7d33b0509c7bd50c5e76e8a0304fa88dcad63a9e2cd0694a5c56f4a21ae363

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
6e38a6bed88e1c27155e4dc428188ef0

SHA1
8b47a1960ed157f7beeb80fa4a16a723279c4efa

SHA256
144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924

SHA512
3b801875bc5a483eea6d6cc43015e759ee1f66c12585f698cb92368455f25b5309617c8beae39945cadb57009a9c9a9ce21c18dec28e86097c67d8fc5f9febab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
2ac1289e4dbab076b332869bef26d3ce

SHA1
60570ddd06b671e26c6a814b9c08cdfa0ef38aba

SHA256
6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26

SHA512
e226fb4739d66e2c4624a9e01ec00dbe3b37dc96995eec35660208d76a9e6758a2a29be1b7986d14074df23ea0fc39d2ce121b7bd32c553371c1b15ff3e2ef7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
1af2a91dc0a4e48bab0ca123073adf30

SHA1
cf6625fd31b17d46dd31b16372840c74026d0ba2

SHA256
ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc

SHA512
45103c51fc655f608e687c8e9db24c956d12c63b0497ced3817aee3d9f5fadf0741064ccb49ae71fbf377228af315c961fa414221731ea4892425ed4939bbf51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
f53ed8a0c18157b9e37500621dfab9ee

SHA1
b8a3131150cfd46052353309843c802d9f43df03

SHA256
5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47

SHA512
2cc98322e67ff49aacaba0b23fb559a5c4c58182e4f3965673a766d3198a26fcd7c7c340779d9fb0fc3f2649c16427ff312d87caa1feadf23dabc6675169416a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\python39.dll

Filesize
4.3MB

MD5
2135da9f78a8ef80850fa582df2c7239

SHA1
aac6ad3054de6566851cae75215bdeda607821c4

SHA256
324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3

SHA512
423b03990d6aa9375ce10e6b62ffdb7e1e2f20a62d248aac822eb9d973ae2bf35deddd2550a4a0e17c51ad9f1e4f86443ca8f94050e0986daa345d30181a2369

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\ucrtbase.dll

Filesize
973KB

MD5
ed82e9c6c4f7a475d7fd6ebabf3fab2a

SHA1
1062942b1bdfc8d7c8a941c152df69216010d780

SHA256
4c5b8e529854cedfa8f46cd6906952400cdbbf25efc4cf37dda2c42d8e96ddcb

SHA512
bf7bdf4762455a1224cdf1e7cdeb73a3c24c3e04d0b01df9f46b87d174cf4a88621372aa87b7e622b210f63a453c911d88e214ba67560f8ff7d7d0d24da58ad2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads