de7384b0fe1a8564d9ca22fcd0e9e7ee8ec3d09a86b017c54d0db51131a8b576 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 16:47

Sharing

Report Analysis Logs

General

Target

stub.exe
Size

8.3MB
MD5

2abbfb25196ba45ccc85c32898b8d50d
SHA1

eb6299f7ed55934543244088b6a9144927e49a19
SHA256

de7384b0fe1a8564d9ca22fcd0e9e7ee8ec3d09a86b017c54d0db51131a8b576
SHA512

f97aef78229990a59744a62490d4443c56ef18fdb3b783cb0f7cad31ce31d74fd94fbd7f854180c7f8cae067678a02c1f869f1e39c2fe592409687ecbbd50113
SSDEEP

196608:IoGv8HZ4JFdQmRrdA6lS8Qnf2ODjMnGydS8jyi9IleHq7O2zH:pOYsdQOlaF3MnG38jyi9IleKqkH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

stub.exe

pid	Process
3064	stub.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

stub.exe

description	pid	Process	procid_target
PID 2856 wrote to memory of 3064	2856	stub.exe	30
PID 2856 wrote to memory of 3064	2856	stub.exe	30
PID 2856 wrote to memory of 3064	2856	stub.exe	30

C:\Users\Admin\AppData\Local\Temp\stub.exe
"C:\Users\Admin\AppData\Local\Temp\stub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\stub.exe
  "C:\Users\Admin\AppData\Local\Temp\stub.exe"
  2⤵
  - Loads dropped DLL
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI28562\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit