965faa9d136d712e2a5008849ebee26b11a375a8d6b1e7fce72c9b730afba375

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 13:30

Target

Paranoid v3.4.exe
Size

5.4MB
MD5

b59bbf2b7e8cbffe5379af74aec57b64
SHA1

6b0cdc014d7355f2e49fd21eba49fccfc9fdf78d
SHA256

15d0940cf9eabcd263bc029fcab518c1e6d7d0ccf6c6fee8bd8df39b5cf57719
SHA512

371979adbb472bc46b9c2750a209368ead2ee4d5ba553a329d8cf6303c5d68bc4d96d90cac8fcaed1842be811644b91c084174fc12ac01def402580a27c941b1
SSDEEP

98304:Pxmj6PKIlxpwpzoLLJ3TbwaVvrZE0I7yoFQK15W8ASLmbNYJERw1jrTHNyGswCtG:PxmvIlnw9onJ5hrZEnyiU8AdZYJERur3

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2276	Paranoid v3.4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2276	1732	Paranoid v3.4.exe	30
PID 1732 wrote to memory of 2276	1732	Paranoid v3.4.exe	30
PID 1732 wrote to memory of 2276	1732	Paranoid v3.4.exe	30

C:\Users\Admin\AppData\Local\Temp\Paranoid v3.4.exe
"C:\Users\Admin\AppData\Local\Temp\Paranoid v3.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\Paranoid v3.4.exe
  "C:\Users\Admin\AppData\Local\Temp\Paranoid v3.4.exe"
  2⤵
  - Loads dropped DLL
  PID:2276

C:\Users\Admin\AppData\Local\Temp\_MEI17322\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit