3f7f2fa931e4c9fddf8bf0c4476c00e6298244dfd45ffa967ed1bbdf7aab4c67

Analysis

max time kernel
18s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 15:03

Target

pictrexclient-main/pictrex.exe
Size

9.4MB
MD5

e21afb0ebb35ac0b16ce4d5fdc053966
SHA1

186930b6c3f35e440a3b53c85a1cfc407893ea2a
SHA256

3cebcb7f6b293810f106656b269d6c54868018dead0b5b2ec74d1a336abb7731
SHA512

501e4dbe83daa7981dfaffafc741a9161332617a00b043c412c413b3d9dfc57efd85bd4f23277a8e9c1324266bec11cf3cc4669276ef694cc10a42c598a5bdff
SSDEEP

196608:13u78K/dY3pvuuDfyGR21X5Sp6GemDMPwWRA+xW0o8PYPGAfhzH:Vu7L/dY3pJDfDspfaMPlR+8PEt

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2140	pictrex.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2140	1628	pictrex.exe	29
PID 1628 wrote to memory of 2140	1628	pictrex.exe	29
PID 1628 wrote to memory of 2140	1628	pictrex.exe	29

C:\Users\Admin\AppData\Local\Temp\pictrexclient-main\pictrex.exe
"C:\Users\Admin\AppData\Local\Temp\pictrexclient-main\pictrex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\pictrexclient-main\pictrex.exe
  "C:\Users\Admin\AppData\Local\Temp\pictrexclient-main\pictrex.exe"
  2⤵
  - Loads dropped DLL
  PID:2140

C:\Users\Admin\AppData\Local\Temp\_MEI16282\python311.dll

Filesize
5.5MB

MD5
e2bd5ae53427f193b42d64b8e9bf1943

SHA1
7c317aad8e2b24c08d3b8b3fba16dd537411727f

SHA256
c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400

SHA512
ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036

Download Submit