db67c58d0cfe8a0c205076d06b645b334894bb444f1aa96a2a279b0e237bd8a2

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:36

Target

obfuscated_code.exe(1).exe
Size

12.4MB
MD5

2ffc36dcffe43b32e0520258375ebe07
SHA1

3ecd56ee36c49e437bba465ca077074f1bc6d8b2
SHA256

db67c58d0cfe8a0c205076d06b645b334894bb444f1aa96a2a279b0e237bd8a2
SHA512

d0e5e44283b630f94bae94cfdf39ff092ff9be639c4495e12fdf46e03fb748e59595e8ff64e6401ecddfcd1c1962bd70f84073111fc6e9713c92a10cd1c7c92c
SSDEEP

393216:UXQdqyL01+l+uq+Vv2dQJlewF3MnG3xl5OBsnarIWeRaDH:aq/01+l+uqgv2dQT3MGx2GVRq

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2776	obfuscated_code.exe(1).exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2776	2524	obfuscated_code.exe(1).exe	31
PID 2524 wrote to memory of 2776	2524	obfuscated_code.exe(1).exe	31
PID 2524 wrote to memory of 2776	2524	obfuscated_code.exe(1).exe	31

C:\Users\Admin\AppData\Local\Temp\obfuscated_code.exe(1).exe
"C:\Users\Admin\AppData\Local\Temp\obfuscated_code.exe(1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\obfuscated_code.exe(1).exe
  "C:\Users\Admin\AppData\Local\Temp\obfuscated_code.exe(1).exe"
  2⤵
  - Loads dropped DLL
  PID:2776

C:\Users\Admin\AppData\Local\Temp\_MEI25242\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit