9f9cfe42a0768cc02609fcabf58b8ccce826d5d768e8c6d3a6728f543c4eac53 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 01:53

Sharing

Report Analysis Logs

General

Target

take3.exe
Size

14.3MB
MD5

84c0ea78eb89b7abee5e03ae8ee708e4
SHA1

91339bd35bd8f01868b8ff39d57b2f07fb050a0b
SHA256

9f9cfe42a0768cc02609fcabf58b8ccce826d5d768e8c6d3a6728f543c4eac53
SHA512

ca66588967874065481bbe80c262c55b3c831e3c95a1fb8830581765cc3dbeaa9d5608823aee899de316be9323a986e6866d399f9950af22e37efb527476436f
SSDEEP

393216:KOWd863huc1dQJlAwF3MnG3InVFedWm7NS/xHWgnHz:b893hr1dQ53MG4VAHsT

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

take3.exe

pid	Process
2492	take3.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

take3.exe

description	pid	Process	procid_target
PID 2908 wrote to memory of 2492	2908	take3.exe	31
PID 2908 wrote to memory of 2492	2908	take3.exe	31
PID 2908 wrote to memory of 2492	2908	take3.exe	31

C:\Users\Admin\AppData\Local\Temp\take3.exe
"C:\Users\Admin\AppData\Local\Temp\take3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\take3.exe
  "C:\Users\Admin\AppData\Local\Temp\take3.exe"
  2⤵
  - Loads dropped DLL
  PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI29082\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit