c1de15b5d043dd79dd267dd5f6d8f3ea9e15bc8a2ab63cb5fb4080cb4804c18e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

crss.exe
Size

12.9MB
MD5

d9ac11dbc44efa13f0563808c1a3a0d4
SHA1

7cbb463d42d753bf743b64a63e2f23e79ccc5e77
SHA256

3df7f30e5e00e9b6f89d383d453dc6202cc16e81b1ff79f4cfd360f0fddf01e7
SHA512

dbae696315da00a4fa2bc06cb9081d842b27742fa228363225ec8889509c578e031d4caf5de267f36bb58be3dbf4298a2ebc3a2d29e00774046a1122c2b8b82b
SSDEEP

393216:nhZ2YsHFUK2J8DfDg0c6c9g1fk/LBIVYA:hZ2YwUlJ8b0bQkFT

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

crss.exe

pid process

324 crss.exe

pid	process
324	crss.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

crss.exe

description	pid	process	target process
PID 752 wrote to memory of 324	752	crss.exe	crss.exe
PID 752 wrote to memory of 324	752	crss.exe	crss.exe
PID 752 wrote to memory of 324	752	crss.exe	crss.exe

C:\Users\Admin\AppData\Local\Temp\crss.exe
"C:\Users\Admin\AppData\Local\Temp\crss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\crss.exe
  "C:\Users\Admin\AppData\Local\Temp\crss.exe"
  2⤵
  - Loads dropped DLL
  PID:324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI7522\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7522\setuptools\_vendor\importlib_resources-6.4.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7522\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE

Filesize
1023B

MD5
141643e11c48898150daa83802dbc65f

SHA1
0445ed0f69910eeaee036f09a39a13c6e1f37e12

SHA256
86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741

SHA512
ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7522\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

Filesize
92B

MD5
43136dde7dd276932f6197bb6d676ef4

SHA1
6b13c105452c519ea0b65ac1a975bd5e19c50122

SHA256
189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714

SHA512
e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1

Download Submit