1dc4ecb493c5e6319426306929fe0e667c7c5de0326ef29893c7cbb54ee3a370

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 18:05

Target

Method/Method/MailDumper v1.2.3.exe
Size

14.0MB
MD5

203069c34e0ca0aa5f9989f017183c7d
SHA1

56c8d23005e226fade5bb89e65fcb6cb54f61d55
SHA256

0bc9a0422c1cd4b679b5d827340d902e10916c8612c202ba899faa8becd94fc8
SHA512

f6752eea901b1d45a3595fafc1fd246ae976ee3cf2b4a290c290afd60a5ae02f6092374dcf292710139987beec68d70fb9bf531be262657bc5088da8d19ed5b8
SSDEEP

393216:bSatY8L2Vmd6melh2pOc/e+7G99YPzAr5jEGuKsV:bSai8yVmdKQpOunzseG6

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2592	MailDumper v1.2.3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2592	2060	MailDumper v1.2.3.exe	31
PID 2060 wrote to memory of 2592	2060	MailDumper v1.2.3.exe	31
PID 2060 wrote to memory of 2592	2060	MailDumper v1.2.3.exe	31

C:\Users\Admin\AppData\Local\Temp\Method\Method\MailDumper v1.2.3.exe
"C:\Users\Admin\AppData\Local\Temp\Method\Method\MailDumper v1.2.3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\Method\Method\MailDumper v1.2.3.exe
  "C:\Users\Admin\AppData\Local\Temp\Method\Method\MailDumper v1.2.3.exe"
  2⤵
  - Loads dropped DLL
  PID:2592

C:\Users\Admin\AppData\Local\Temp\_MEI20602\python310.dll

Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit