c65bb019b27ce608df2aa415c0cb32cecf7d3297b84f232301b426e2fa98dbe7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 14:29

Target

PLHybrid/PLHybrid/SetupPL.exe
Size

19KB
MD5

7736ba935ee07706ab86ffd37127dd3c
SHA1

8106fdf9b24d382de52c1030e86597aff57c0288
SHA256

78be7f951a20b676529805aec38cc151b250862fc823fb9f50fa3f68f3ae8fc5
SHA512

e5587b52619de1f32c55e0045e2d0f6306e67aa2858a104a698be8b51b721040df1aa5b374793e8499f841f8afa4d6ca3fe716fd28342bda7edad07efe0be2cd
SSDEEP

192:VE5+KytpzgH4zZZE8RcNRj26q1Lekr/VckBTR0RZwJT3plhpsfhAsAVYsQ5Xfccw:VCytpzgH4zL5uv+vxBt0R6TfhebsnGY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2900	2012	SetupPL.exe	31
PID 2012 wrote to memory of 2900	2012	SetupPL.exe	31
PID 2012 wrote to memory of 2900	2012	SetupPL.exe	31

C:\Users\Admin\AppData\Local\Temp\PLHybrid\PLHybrid\SetupPL.exe
"C:\Users\Admin\AppData\Local\Temp\PLHybrid\PLHybrid\SetupPL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python --version
  2⤵
  PID:2900