4373afaa735149fa377994bf045b5ea884dacc3b709de121269abc087c10187d

Resubmissions

29/07/2024, 08:41

28/07/2024, 03:15

max time kernel
359s
max time network
368s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/07/2024, 08:41

Target
edited_ransom.exe
Size 12.8MB
Sample240729-kls7msvard
SHA256 4373afaa735149fa377994bf045b5ea884dacc3b709de121269abc087c10187d
MD5 54c99a11b63dc6f7a017289073850e9d
SHA1 9ee4d0bf7cd780aacd437ff0b21e011bf5e94649
SHA512 c569cbd59214c780bd4cb81e0d509ede88e29a1d587ad7f860824e29985162967d9176cbdbff8c80501db8fbf2eb69e1dbfd9f9af9f3ba09f3c9c91941268dd7
SSDEEP 393216:sqoJWQsUcR4NzK1+TtIiEY9Z8D8CclyhCW8SInoXx:stYQFS1QtIla8DZczW8S
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1164	edited_ransom.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1164	2572	edited_ransom.exe	31
PID 2572 wrote to memory of 1164	2572	edited_ransom.exe	31
PID 2572 wrote to memory of 1164	2572	edited_ransom.exe	31

C:\Users\Admin\AppData\Local\Temp\edited_ransom.exe
"C:\Users\Admin\AppData\Local\Temp\edited_ransom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\edited_ransom.exe
  "C:\Users\Admin\AppData\Local\Temp\edited_ransom.exe"
  2⤵
  - Loads dropped DLL
  PID:1164

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\python312.dll
Size 6.6MB
SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
MD5 3c388ce47c0d9117d2a50b3fa5ac981d
SHA1 038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA512 e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35
SSDEEP 49152:77dFcaC296MwQx0AWOO5JqSEShouly4XUV/x3aOvi5lnX79DxW/En8tdFNPhD2SI:7Z+aCnAh8lRA4jvE0ivHHDMiEBaw
MD5 SHA1 SHA512 SSDEEP

Submit Download