4de1944bcb4d350ca0a273532fbbca28defd46af1098a555fd550d76429991ef | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/11/2024, 00:27

Sharing

Report Analysis Logs

General

Target

source_prepared.exe
Size

102.9MB
MD5

f0cf711a8c7a41ac9c342aa53a7628f8
SHA1

b0839d815ac31cfb3882d6d3adc46ad4a180024a
SHA256

4de1944bcb4d350ca0a273532fbbca28defd46af1098a555fd550d76429991ef
SHA512

cd228e86776383d79d9cfcf05afaf3ee2e25c94776e0bc8a170ff7e6fd7c6dacdd2a390827affc1a3aaa3ccf5cf253aa451ea30b10ed167c8270e9dd0253ae44
SSDEEP

3145728:/nGXaCRrS6xjKcBanL2qHO5iVAunGQbRe0zJcBahZ2:+XFZSWNaBHCin1XcBt

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1920	source_prepared.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1920	2828	source_prepared.exe	30
PID 2828 wrote to memory of 1920	2828	source_prepared.exe	30
PID 2828 wrote to memory of 1920	2828	source_prepared.exe	30

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI28282\python312.dll

Filesize
6.6MB

MD5
b243d61f4248909bc721674d70a633de

SHA1
1d2fb44b29c4ac3cfd5a7437038a0c541fce82fc

SHA256
93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7

SHA512
10460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb

Download Submit