6b1700a3961f46120afdf3c5e027556682badcae0015503d533c9f808f214ddc

Resubmissions

22/09/2024, 11:21

19/09/2024, 15:20

19/09/2024, 13:36

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/09/2024, 11:21

Target

RatAlerts.exe
Size

36.7MB
MD5

f921e16ca321bbe2e490f036f8b99c74
SHA1

6e25638b340ba77f3e467bbbdc27c48209e193af
SHA256

6b1700a3961f46120afdf3c5e027556682badcae0015503d533c9f808f214ddc
SHA512

04492839ccaeeddc9090b7f6c6458294540bb3e2589108a3c459ae87a11c6cabe6548d80805f37b8bd43616d3645afdabe8b95b9f37c85c06f5c87b137a10274
SSDEEP

786432:pjE3Qtst8rW8WZ2YwUlJAdQ/2j6+s7LWB75zuXVgM3MGYS2fAMJLjvZ:a3QtIoWlZ2mlq62qHWB75ilZMGJ24MRN

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1076	RatAlerts.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1076	2544	RatAlerts.exe	32
PID 2544 wrote to memory of 1076	2544	RatAlerts.exe	32
PID 2544 wrote to memory of 1076	2544	RatAlerts.exe	32

C:\Users\Admin\AppData\Local\Temp\RatAlerts.exe
"C:\Users\Admin\AppData\Local\Temp\RatAlerts.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\RatAlerts.exe
  "C:\Users\Admin\AppData\Local\Temp\RatAlerts.exe"
  2⤵
  - Loads dropped DLL
  PID:1076

C:\Users\Admin\AppData\Local\Temp\_MEI25442\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit