88b73e930b82693cc6f242084c06d978cb343144f32bd997a9e4021917b4c182

Resubmissions

14-10-2024 21:39

11-10-2024 13:56

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 13:56

Target

Drk's ByfronFucker/Drk's Exec Fixer.exe
Size

19.7MB
MD5

13438bbb217df2027c360f968c81946e
SHA1

48fa6d05428d4381c938198ba93c411eae23d04f
SHA256

bce5821b1872c63ba22dbb67c0ccc17d7efbb74369cdd9d8693ac11cdfbd8a80
SHA512

4ef8cd381048d55b1e0c3dbe591f3018e809054cf401749d4f3b90fa10453b7211fe17e9216bc9edcd732bdd32852f815fc2c4d6b6740e0672e05e5f5c34719f
SSDEEP

393216:MQzEkZQtslPpUTLfhJKQETSrvJQ7Wr07zGxd0m2o:MOhQtsTUTLJQQEWrhQShch

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2544	Drk's Exec Fixer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2544	2472	Drk's Exec Fixer.exe	30
PID 2472 wrote to memory of 2544	2472	Drk's Exec Fixer.exe	30
PID 2472 wrote to memory of 2544	2472	Drk's Exec Fixer.exe	30

C:\Users\Admin\AppData\Local\Temp\Drk's ByfronFucker\Drk's Exec Fixer.exe
"C:\Users\Admin\AppData\Local\Temp\Drk's ByfronFucker\Drk's Exec Fixer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\Drk's ByfronFucker\Drk's Exec Fixer.exe
  "C:\Users\Admin\AppData\Local\Temp\Drk's ByfronFucker\Drk's Exec Fixer.exe"
  2⤵
  - Loads dropped DLL
  PID:2544

C:\Users\Admin\AppData\Local\Temp\_MEI24722\python311.dll

Filesize
5.5MB

MD5
5a5dd7cad8028097842b0afef45bfbcf

SHA1
e247a2e460687c607253949c52ae2801ff35dc4a

SHA256
a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

SHA512
e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

Download Submit