33c0c309dba1ae1539b6e49b881f1abb5679ffcabf84fda8e5a4d52f588aa0a8 | Triage

Analysis

max time kernel
35s
max time network
17s
platform
windows7_x64
resource
win7-20240704-es
resource tags

arch:x64arch:x86image:win7-20240704-eslocale:es-esos:windows7-x64systemwindows
submitted
31/08/2024, 04:02

Sharing

Report Analysis Logs

General

Target

Skin Changer.exe
Size

12.2MB
MD5

61c842c4a5405955777dedab86174b67
SHA1

c90ae53beec6a847ab13db03156f4661361a9918
SHA256

33c0c309dba1ae1539b6e49b881f1abb5679ffcabf84fda8e5a4d52f588aa0a8
SHA512

b4376d9544cf7f280aad0c81462b954fd11cb9e6fedee6b71b48439866480a6d530c34d51f1cfa3aea096af2a123f2b3a112f1aa55f1699f720a14d82fa5cf4b
SSDEEP

393216:AQdqtWL01+l+uq+VvedQJlewF3MnG3xl5lcgGLrlcTuOs:AqCq01+l+uqgvedQT3MGxdZ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2556	Skin Changer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2556	2704	Skin Changer.exe	30
PID 2704 wrote to memory of 2556	2704	Skin Changer.exe	30
PID 2704 wrote to memory of 2556	2704	Skin Changer.exe	30

C:\Users\Admin\AppData\Local\Temp\Skin Changer.exe
"C:\Users\Admin\AppData\Local\Temp\Skin Changer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\Skin Changer.exe
  "C:\Users\Admin\AppData\Local\Temp\Skin Changer.exe"
  2⤵
  - Loads dropped DLL
  PID:2556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI27042\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit