378a445c2995010f1a268b7ff8f311660fc2f8dabca36ff985ebdba11868c99d | Triage

Analysis

max time kernel
359s
max time network
361s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 14:39

Sharing

Report Analysis Logs

General

Target

PeakGen_v2.exe
Size

6.8MB
MD5

14caf40258fa0ab56553184460d1ea85
SHA1

480dcbdb52d0258c38965e55fbfe9650568b23d9
SHA256

378a445c2995010f1a268b7ff8f311660fc2f8dabca36ff985ebdba11868c99d
SHA512

2d1bd9f6619507f7eb4b0b368dd1a03ba24c6a7348e243b8a7c7aaf564045164f2e36c48dc33d035582bfed4ca59de2b9f1d9901a30f18ddb84293e51d553229
SSDEEP

196608:5OX4FMIZETSwjPePdrQJ/Bd1WyYtYPjo:KQETSwvJH1WyUao

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2840	PeakGen_v2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2840	2768	PeakGen_v2.exe	31
PID 2768 wrote to memory of 2840	2768	PeakGen_v2.exe	31
PID 2768 wrote to memory of 2840	2768	PeakGen_v2.exe	31

C:\Users\Admin\AppData\Local\Temp\PeakGen_v2.exe
"C:\Users\Admin\AppData\Local\Temp\PeakGen_v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\PeakGen_v2.exe
  "C:\Users\Admin\AppData\Local\Temp\PeakGen_v2.exe"
  2⤵
  - Loads dropped DLL
  PID:2840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI27682\python311.dll

Filesize
5.5MB

MD5
5a5dd7cad8028097842b0afef45bfbcf

SHA1
e247a2e460687c607253949c52ae2801ff35dc4a

SHA256
a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

SHA512
e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

Download Submit