513b78b31dd7cacc0db39b1bee74d51691cc050cadba9406d377f22492328d57 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 02:55

Sharing

Report Analysis Logs

General

Target

gui.exe
Size

62.3MB
MD5

1b6e159ca1f99c85b53712925b099d78
SHA1

99d7891c0ec4463e8e39ad309d31898fc58a8771
SHA256

513b78b31dd7cacc0db39b1bee74d51691cc050cadba9406d377f22492328d57
SHA512

7236a25ae7ab2da9eb718107ea6e3f09cd4e15c63f17302e712c9087037e65018a11c8aa077875aa866a197667a45e7b9ae682fbbd7e5569de1eb393f72ffc90
SSDEEP

1572864:gWATaTzg+0U9Uo7Z/kho5lbJaw0ILPtN6UaoMTUzkL5/2y06:ghWTzgW9kC5lVawZvaoUgu2b6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2444	gui.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2444	2684	gui.exe	31
PID 2684 wrote to memory of 2444	2684	gui.exe	31
PID 2684 wrote to memory of 2444	2684	gui.exe	31

C:\Users\Admin\AppData\Local\Temp\gui.exe
"C:\Users\Admin\AppData\Local\Temp\gui.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\gui.exe
  "C:\Users\Admin\AppData\Local\Temp\gui.exe"
  2⤵
  - Loads dropped DLL
  PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI26842\python311.dll

Filesize
5.5MB

MD5
58e01abc9c9b5c885635180ed104fe95

SHA1
1c2f7216b125539d63bd111a7aba615c69deb8ba

SHA256
de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837

SHA512
cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

Download Submit