5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe
Size

15.2MB
MD5

dc7127b16ddab37a9bd8709113b9371e
SHA1

bc9c5b6eff8d753514a68602b542f853ebb6cdad
SHA256

5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be
SHA512

b0df47f95da2ca05260da3b6d66933dfebbf8bf3a3c9e2c04418b3c00b2ac8eda9e7afe9781a4011f80b0da6ee20e1098eaeddc281dcfc8f2f5f596393cc3c03
SSDEEP

393216:lcjdTRmN0CMjHfKsYvO+Fr8eMcv7Ha1+TtIiW0VJWLlW30:0NQ0Cg/kvOmAet7Ha1QtI2Ei

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

Processes:

5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe

pid	Process
2852	5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe
2852	5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe
2852	5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe
2852	5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe
2852	5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe
2852	5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe
2852	5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe

description	pid	Process	procid_target
PID 1064 wrote to memory of 2852	1064	5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe	30
PID 1064 wrote to memory of 2852	1064	5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe	30
PID 1064 wrote to memory of 2852	1064	5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe	30

C:\Users\Admin\AppData\Local\Temp\5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe
"C:\Users\Admin\AppData\Local\Temp\5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe
  "C:\Users\Admin\AppData\Local\Temp\5f9d04efa0861f3e761be73188eb193a6f1c0eea151bbf55dc29b735c75a43be.exe"
  2⤵
  - Loads dropped DLL
  PID:2852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI10642\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
5a72a803df2b425d5aaff21f0f064011

SHA1
4b31963d981c07a7ab2a0d1a706067c539c55ec5

SHA256
629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086

SHA512
bf44997c405c2ba80100eb0f2ff7304938fc69e4d7ae3eac52b3c236c3188e80c9f18bda226b5f4fde0112320e74c198ad985f9ffd7cea99aca22980c39c7f69

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10642\api-ms-win-core-file-l2-1-0.dll

Filesize
11KB

MD5
721b60b85094851c06d572f0bd5d88cd

SHA1
4d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7

SHA256
dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf

SHA512
430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10642\api-ms-win-core-localization-l1-2-0.dll

Filesize
14KB

MD5
1ed0b196ab58edb58fcf84e1739c63ce

SHA1
ac7d6c77629bdee1df7e380cc9559e09d51d75b7

SHA256
8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2

SHA512
e1fa7f14f39c97aaa3104f3e13098626b5f7cfd665ba52dcb2312a329639aaf5083a9177e4686d11c4213e28acc40e2c027988074b6cc13c5016d5c5e9ef897b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10642\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
7e8b61d27a9d04e28d4dae0bfa0902ed

SHA1
861a7b31022915f26fb49c79ac357c65782c9f4b

SHA256
1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c

SHA512
1c5b35026937b45beb76cb8d79334a306342c57a8e36cc15d633458582fc8f7d9ab70ace7a92144288c6c017f33ecfc20477a04432619b40a21c9cda8d249f6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10642\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
91a2ae3c4eb79cf748e15a58108409ad

SHA1
d402b9df99723ea26a141bfc640d78eaf0b0111b

SHA256
b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34

SHA512
8527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10642\python312.dll

Filesize
6.6MB

MD5
d521654d889666a0bc753320f071ef60

SHA1
5fd9b90c5d0527e53c199f94bad540c1e0985db6

SHA256
21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2

SHA512
7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10642\ucrtbase.dll

Filesize
1011KB

MD5
849959a003fa63c5a42ae87929fcd18b

SHA1
d1b80b3265e31a2b5d8d7da6183146bbd5fb791b

SHA256
6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232

SHA512
64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09

Download Submit