59c4fdca92ea6d1e6e885185995155c008df2fe84eb88cbb614f4839b9995a1a | Triage

Analysis

max time kernel
1563s
max time network
1564s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 15:34

Sharing

Report Analysis Logs

General

Target

CyberX-Analysis.exe
Size

12.5MB
MD5

8783a8f86b3e5f4febc695bd5ac9309c
SHA1

a3ecbfc62a295783a712563baac9c5be949c716f
SHA256

59c4fdca92ea6d1e6e885185995155c008df2fe84eb88cbb614f4839b9995a1a
SHA512

41ad799d6f6478c7567447ac0c107da8f7ad4cf28767b0a3d8fdfd45cdf15f8dffca6fc57439b69600095d2e57b21b4231caab9b82a116737e4c9ec885cea461
SSDEEP

393216:wwqoGV2IGgpgPYVnNSMF1+TtIiFeZxS1NsIgPOm0:wwwKgpgPQH1QtIZYAIe0

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1936	CyberX-Analysis.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1936	1972	CyberX-Analysis.exe	31
PID 1972 wrote to memory of 1936	1972	CyberX-Analysis.exe	31
PID 1972 wrote to memory of 1936	1972	CyberX-Analysis.exe	31

C:\Users\Admin\AppData\Local\Temp\CyberX-Analysis.exe
"C:\Users\Admin\AppData\Local\Temp\CyberX-Analysis.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\CyberX-Analysis.exe
  "C:\Users\Admin\AppData\Local\Temp\CyberX-Analysis.exe"
  2⤵
  - Loads dropped DLL
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI19722\python312.dll

Filesize
6.6MB

MD5
cae8fa4e7cb32da83acf655c2c39d9e1

SHA1
7a0055588a2d232be8c56791642cb0f5abbc71f8

SHA256
8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

SHA512
db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

Download Submit