e0aca3445c99c4be321fcf167f7edfe4b307c8cded7bfeda7f61673dee79c955 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 15:02

Sharing

Report Analysis Logs

General

Target

KRNL-bootstrapper.exe
Size

13.2MB
MD5

5c14e347317a51194b82ef0855e26e3b
SHA1

77fb645077b717acfb78dee36371a04976b26e2c
SHA256

e0aca3445c99c4be321fcf167f7edfe4b307c8cded7bfeda7f61673dee79c955
SHA512

1a054189f35f7aba31c080e27ebdbbc7bb4fc5110124b1317631a422d9888d51e60cdcd507c1073280b2bb7dfec1de957ec736b112413a70ca48be1baff8b6a1
SSDEEP

393216:owAct+L01+l+uq+Vvj1+TtIiF90VQxzC7P6ga:owQ01+l+uqgvj1QtINSC7PK

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2940	KRNL-bootstrapper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2940	2604	KRNL-bootstrapper.exe	30
PID 2604 wrote to memory of 2940	2604	KRNL-bootstrapper.exe	30
PID 2604 wrote to memory of 2940	2604	KRNL-bootstrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\KRNL-bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\KRNL-bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\KRNL-bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\KRNL-bootstrapper.exe"
  2⤵
  - Loads dropped DLL
  PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI26042\python312.dll

Filesize
6.6MB

MD5
d521654d889666a0bc753320f071ef60

SHA1
5fd9b90c5d0527e53c199f94bad540c1e0985db6

SHA256
21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2

SHA512
7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3

Download Submit