a5b292c0a6d7a38f156c7a8a8709ffe63419c8eaa09edb521f2aca6db0fbbffe

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/11/2024, 01:26

Target

AntivirusApp.exe
Size

132.8MB
MD5

dab64b19dbc5f2c80cea565386b3ce2d
SHA1

ad0e294c464540019c931e45c04b1fafaf078b41
SHA256

a5b292c0a6d7a38f156c7a8a8709ffe63419c8eaa09edb521f2aca6db0fbbffe
SHA512

93e9ff32e1c866a79c04db988aff4541c69ceec3b0d83f0ac2e13899ffa20abf1b14da2016d8573642fe9cc3e6768de1d27ba0279f1048205f1185c315702a69
SSDEEP

3145728:F/dukp4gwPvP+4tG5YwUSC++uy65C4H0j59s+nX3dcrzD:FEJgwPXjtGagCMy2CY0j5S+Hdcz

Score

4^/10

Loads dropped DLL 1 IoCs

pid	Process
2580	AntivirusApp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2580	2496	AntivirusApp.exe	30
PID 2496 wrote to memory of 2580	2496	AntivirusApp.exe	30
PID 2496 wrote to memory of 2580	2496	AntivirusApp.exe	30

C:\Users\Admin\AppData\Local\Temp\AntivirusApp.exe
"C:\Users\Admin\AppData\Local\Temp\AntivirusApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\AntivirusApp.exe
  "C:\Users\Admin\AppData\Local\Temp\AntivirusApp.exe"
  2⤵
  - Loads dropped DLL
  PID:2580

C:\Users\Admin\AppData\Local\Temp\_MEI24962\PyQt5\Qt5\translations\qtlocation_en.qm

Filesize
16B

MD5
bcebcf42735c6849bdecbb77451021dd

SHA1
4884fd9af6890647b7af1aefa57f38cca49ad899

SHA256
9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85

SHA512
f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24962\python312.dll

Filesize
6.6MB

MD5
cae8fa4e7cb32da83acf655c2c39d9e1

SHA1
7a0055588a2d232be8c56791642cb0f5abbc71f8

SHA256
8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

SHA512
db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

Download Submit