0ccde4ad4a65e1d632eaa5cf73e59172d06d45187a390a6677a46bef50a59da1 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:35

Sharing

Report Analysis Logs

General

Target

obfuscated_code.exe
Size

12.4MB
MD5

2ffc36dcffe43b32e0520258375ebe07
SHA1

3ecd56ee36c49e437bba465ca077074f1bc6d8b2
SHA256

db67c58d0cfe8a0c205076d06b645b334894bb444f1aa96a2a279b0e237bd8a2
SHA512

d0e5e44283b630f94bae94cfdf39ff092ff9be639c4495e12fdf46e03fb748e59595e8ff64e6401ecddfcd1c1962bd70f84073111fc6e9713c92a10cd1c7c92c
SSDEEP

393216:UXQdqyL01+l+uq+Vv2dQJlewF3MnG3xl5OBsnarIWeRaDH:aq/01+l+uqgv2dQT3MGx2GVRq

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2752	obfuscated_code.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2752	2164	obfuscated_code.exe	32
PID 2164 wrote to memory of 2752	2164	obfuscated_code.exe	32
PID 2164 wrote to memory of 2752	2164	obfuscated_code.exe	32

C:\Users\Admin\AppData\Local\Temp\obfuscated_code.exe
"C:\Users\Admin\AppData\Local\Temp\obfuscated_code.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\obfuscated_code.exe
  "C:\Users\Admin\AppData\Local\Temp\obfuscated_code.exe"
  2⤵
  - Loads dropped DLL
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI21642\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit