0c4bbb21db8c983e9ae8e3c887cdd84bdc301b488d96305d1590baf61e770613 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 11:55

Sharing

Report Analysis Logs

General

Target

fulloption-gg.exe
Size

8.2MB
MD5

e706284bc99803ad33ff4ea3e7ba888c
SHA1

b8a7f0700cbbb8ab229fda7189287b4283442c13
SHA256

0c4bbb21db8c983e9ae8e3c887cdd84bdc301b488d96305d1590baf61e770613
SHA512

8def34539fa5923e4a6f960a126e0d6ae24cde1938d4ddc86103e77a50be332d77769ae0002a8415b0bf21b35321e8e3616e461db4bd19e8f92ec7f20f9535a3
SSDEEP

196608:PXy/hwuLIoBA1HeT39IigQh1ncKOVVtk7bUZtQ1NQPxtKh:f0aIq1+TtIiLv0VQ26uKh

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2708	fulloption-gg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2708	2584	fulloption-gg.exe	31
PID 2584 wrote to memory of 2708	2584	fulloption-gg.exe	31
PID 2584 wrote to memory of 2708	2584	fulloption-gg.exe	31

C:\Users\Admin\AppData\Local\Temp\fulloption-gg.exe
"C:\Users\Admin\AppData\Local\Temp\fulloption-gg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\fulloption-gg.exe
  "C:\Users\Admin\AppData\Local\Temp\fulloption-gg.exe"
  2⤵
  - Loads dropped DLL
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI25842\python312.dll

Filesize
6.6MB

MD5
d521654d889666a0bc753320f071ef60

SHA1
5fd9b90c5d0527e53c199f94bad540c1e0985db6

SHA256
21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2

SHA512
7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3

Download Submit