61727c63f5f90817db6c6c2acd39e3318ddb391a2fd5df7d6e912ce11ce6b1b7

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:32

Target

Hellion.exe
Size

11.2MB
MD5

820c6965214acd43b76e4e3284c0b20b
SHA1

610720cb6b74a5607572fbe0d5c7ddfecdcba425
SHA256

f2f8d895bf14040bea035eee3949106730df11d5eb525dd543e988b40483389f
SHA512

157370fb150370240781bd14fa4f671002d0beb030db29f1520a86fdf9693c640fa4bd4806c5627df0d7fbfd379117f8a711e4ff0b5100743d2e0078a3bea9d6
SSDEEP

196608:aJRz+b4RwkU3b01Kpn3V+uq+VvpHxbAQvemuEtwq+ZkiKDISc7x0vaMLw0d2:yp+t3L01+l+uq+VvFxv99aq+ZkFYx05L

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

Hellion.exe

pid	Process
2716	Hellion.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Hellion.exe

description	pid	Process	procid_target
PID 2904 wrote to memory of 2716	2904	Hellion.exe	30
PID 2904 wrote to memory of 2716	2904	Hellion.exe	30
PID 2904 wrote to memory of 2716	2904	Hellion.exe	30

C:\Users\Admin\AppData\Local\Temp\Hellion.exe
"C:\Users\Admin\AppData\Local\Temp\Hellion.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\Hellion.exe
  "C:\Users\Admin\AppData\Local\Temp\Hellion.exe"
  2⤵
  - Loads dropped DLL
  PID:2716

C:\Users\Admin\AppData\Local\Temp\_MEI29042\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit