Resubmissions

23-08-2024 12:27

240823-pmq6wstdmh 10

Analysis

  • max time kernel
    12s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23-08-2024 12:27

General

  • Target

    Windinject.exe

  • Size

    79.0MB

  • MD5

    6167f9f62a50b89b5d1d980039bbc387

  • SHA1

    185cee450e86be4b4b97642109bf4ecbf0411929

  • SHA256

    00ddd17fc113fcca57da61267e5cb8b762db0675aaf4afa7f7870c2474b39e05

  • SHA512

    c8b881429819039a4385d0a96ed703604ed402247dd6d8229d0a0b9a267aeff4d19b21a86bf4d86a042f53eb6e232e54f82e6e621bf8a0230e0119872821b96f

  • SSDEEP

    1572864:XvxZQglV3mWMSk8IpG7V+VPhqCMNE7TlgHtqiYgj+h58sMwt9z81cJzi:XvxZxfWhSkB05awCMkeNE5R9zni

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windinject.exe
    "C:\Users\Admin\AppData\Local\Temp\Windinject.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\Windinject.exe
      "C:\Users\Admin\AppData\Local\Temp\Windinject.exe"
      2⤵
      • Loads dropped DLL
      PID:276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI29762\python311.dll

    Filesize

    1.6MB

    MD5

    ffd85743633296368dcc81c9ff0e8554

    SHA1

    ccf28c70bbf853dbd6cd258f59836f25774f1c34

    SHA256

    286483910be593ce685c0377463aa3250528fa22a08e1d38e831659ed81f12c1

    SHA512

    65b9baaf31abd0a71571c6567290fea86b986c6dba2f747cd24158226ef4a32af37ccf4ea461658c5822fda9de1525d8f4e19ed473c349c6d2db664d8d4c2b07

  • memory/276-1253-0x000007FEF6100000-0x000007FEF66E9000-memory.dmp

    Filesize

    5.9MB