5e805cf9d339a63f809cf7754fc94f681a70a0d306f230cf05c1f6f95c7ce725 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 16:35

Sharing

Report Analysis Logs

General

Target

log_sorter.exe
Size

5.1MB
MD5

b7f1ec25e6e1419e6cf8e9afabff226e
SHA1

35aa7bf00e5b2e8b2748f4b8e0a925650b5dc5e1
SHA256

5e805cf9d339a63f809cf7754fc94f681a70a0d306f230cf05c1f6f95c7ce725
SHA512

e6ed2b312329a73c41153cfd44d1ac0a10bfd801fcbede17d4bfb7e70ec9f347b74948b73891ffd7b3ca8cbfe50014e11c6e2f1271a63a82408dbdd1a6c7f1ac
SSDEEP

98304:jz8UD9k2uW5MI0CJFnHunzDAZku99mwUaQcNrdN6wq:jz5DFL2VCJVAzDaku99mEQcDN6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2968	log_sorter.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2968	2236	log_sorter.exe	32
PID 2236 wrote to memory of 2968	2236	log_sorter.exe	32
PID 2236 wrote to memory of 2968	2236	log_sorter.exe	32

C:\Users\Admin\AppData\Local\Temp\log_sorter.exe
"C:\Users\Admin\AppData\Local\Temp\log_sorter.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\log_sorter.exe
  "C:\Users\Admin\AppData\Local\Temp\log_sorter.exe"
  2⤵
  - Loads dropped DLL
  PID:2968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI22362\python39.dll

Filesize
4.3MB

MD5
19e6d310c1bd0578d468a888d3ec0e3d

SHA1
32561ad9b89dc9e9a086569780890ad10337e698

SHA256
f4609ec3bbcc74ed9257e3440ec15adf3061f7162a89e4e9a370e1c2273370a1

SHA512
4a8332c22a40a170ea83fc8cfd5b8a0ed0df1d59fd22ebe10088ba0be78cc0e91a537d7085549a4d06204cbe77e83154a812daed885c25aa4b4cb4aca5b9cc85

Download Submit