e6844580a1f34017f39c9ccb18701d35dc188906627c160e9e7560797ce96b61 | Triage

Resubmissions

22-08-2024 23:30

240822-3hhkvatcqa 10

12-05-2024 12:29

240512-ppdzcahh26 10

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 23:30

Sharing

Report Analysis Logs

General

Target

RC7_UI.exe
Size

6.8MB
MD5

f42aa2d94c14285803251e1391a9a316
SHA1

df81d77ec0ee8b57197d9a0c5516f8154d01a81f
SHA256

e6844580a1f34017f39c9ccb18701d35dc188906627c160e9e7560797ce96b61
SHA512

c751bed23ca0e275c70e6b124998f225618d25eaa6302cc9926d77af79ebc2e82d519834899a539e9dc6667e0f76b09d3067496437984567f6142e54990f8d61
SSDEEP

196608:bh/MzQ01k/w1W903eV4QS993iObMGuLmGQ1Zc:+Q02/mW+eGQ493iObyLxQc

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1620	RC7_UI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1620	2312	RC7_UI.exe	31
PID 2312 wrote to memory of 1620	2312	RC7_UI.exe	31
PID 2312 wrote to memory of 1620	2312	RC7_UI.exe	31

C:\Users\Admin\AppData\Local\Temp\RC7_UI.exe
"C:\Users\Admin\AppData\Local\Temp\RC7_UI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\RC7_UI.exe
  "C:\Users\Admin\AppData\Local\Temp\RC7_UI.exe"
  2⤵
  - Loads dropped DLL
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI23122\python311.dll

Filesize
5.5MB

MD5
65e381a0b1bc05f71c139b0c7a5b8eb2

SHA1
7c4a3adf21ebcee5405288fc81fc4be75019d472

SHA256
53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a

SHA512
4db465ef927dfb019ab6faec3a3538b0c3a8693ea3c2148fd16163bf31c03c899dfdf350c31457edf64e671e3cc3e46851f32f0f84b267535bebc4768ef53d39

Download Submit