6ba79505401e365e61b605e44264864d804592495f169d43ad062ed140d4ebba | Triage

Resubmissions

23/10/2024, 10:40

241023-mq146avhle 10

23/10/2024, 10:39

241023-mp2djavgrb 10

Analysis

max time kernel
29s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23/10/2024, 10:39

Sharing

Report Analysis Logs

General

Target

source_prepared.exe
Size

107.2MB
MD5

627e8bc0dd7a740b066980758dbcf2ad
SHA1

3593e152b08af0cc607e77eb627f73b3bd28f0a3
SHA256

6ba79505401e365e61b605e44264864d804592495f169d43ad062ed140d4ebba
SHA512

dd6b195353d821146acd049d5d119a10cdb5a5984020807ce09064289e0f73dfafcf604aca6810c9b516d4a0fcb892dc760a48a3f654ed5fa6d4b0c0278388e5
SSDEEP

3145728:eUer7RS6xjKcBa6/2qHO5iFpBnG0iWMstB2OxQtyX7:9YFSWNa6NHCibhieB

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2360	source_prepared.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2360	1744	source_prepared.exe	32
PID 1744 wrote to memory of 2360	1744	source_prepared.exe	32
PID 1744 wrote to memory of 2360	1744	source_prepared.exe	32

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI17442\python311.dll

Filesize
5.5MB

MD5
387bb2c1e40bde1517f06b46313766be

SHA1
601f83ef61c7699652dec17edd5a45d6c20786c4

SHA256
0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364

SHA512
521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad

Download Submit