6399b9b0999a8429a933fc9f1c0a117801ac881682c12727ef25656e28ba421d | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 14:21

Sharing

Report Analysis Logs

General

Target

prank.exe
Size

14.5MB
MD5

3848137b0a5128ee5bdb4216d87bd2ea
SHA1

fa7414a21a517d376f51fe7afed7d25949d05ae3
SHA256

f92d50349e45df360b6aec4c47c4d3fa53e79575da3f417a1530ada0c4deb7dc
SHA512

6c6f03bdd0a15e20798d23ee8749ce3e315910eceb30e49bd8b104af302bd98f5061a1967e596dca6bfc0e81b7b3017e39e952d3a92642b950076fe159d6c1b0
SSDEEP

393216:LiIE7YoDUHk3mescGfdsYc2Pz21t/XYNk/yK3mkMII2:47rDCaG5FsjE+/YLKWu

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2928	prank.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2928	2936	prank.exe	31
PID 2936 wrote to memory of 2928	2936	prank.exe	31
PID 2936 wrote to memory of 2928	2936	prank.exe	31

C:\Users\Admin\AppData\Local\Temp\prank.exe
"C:\Users\Admin\AppData\Local\Temp\prank.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\prank.exe
  "C:\Users\Admin\AppData\Local\Temp\prank.exe"
  2⤵
  - Loads dropped DLL
  PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI29362\python311.dll

Filesize
5.5MB

MD5
58e01abc9c9b5c885635180ed104fe95

SHA1
1c2f7216b125539d63bd111a7aba615c69deb8ba

SHA256
de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837

SHA512
cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

Download Submit