2089b042f8bd0708849973ee3f3ff2769477589a514c66641ccdf39e2c0bee32 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 14:58

Sharing

Report Analysis Logs

General

Target

File_Sorter.exe
Size

28.3MB
MD5

99ea5060c048ad75553acd603d1fdfec
SHA1

d8b0609a171ad9ee5bfc37ac9332dc652f013624
SHA256

2089b042f8bd0708849973ee3f3ff2769477589a514c66641ccdf39e2c0bee32
SHA512

45b5c3887855b5e59d372466b93f605fe1ed4f61ad2f760f724685572ba15af7b3979ad8bc067ebda8ee4dbfda285e5dfe8619cf75e35a70edf11ee4acc5c57c
SSDEEP

786432:5JS+kO0vW+e5RY2j6+s7LWB75zuL6p9Ma5qW80hz3Sw:bkdvW+eHY2qHWB75iLHacW7

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1492	File_Sorter.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1492	2220	File_Sorter.exe	30
PID 2220 wrote to memory of 1492	2220	File_Sorter.exe	30
PID 2220 wrote to memory of 1492	2220	File_Sorter.exe	30

C:\Users\Admin\AppData\Local\Temp\File_Sorter.exe
"C:\Users\Admin\AppData\Local\Temp\File_Sorter.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\File_Sorter.exe
  "C:\Users\Admin\AppData\Local\Temp\File_Sorter.exe"
  2⤵
  - Loads dropped DLL
  PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI22202\python312.dll

Filesize
6.6MB

MD5
5c5602cda7ab8418420f223366fff5db

SHA1
52f81ee0aef9b6906f7751fd2bbd4953e3f3b798

SHA256
e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce

SHA512
51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f

Download Submit