84dc07f9e850b5c47ebee63d4262ea9b7fa82a49b01132581b923d19858dc9e8 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 21:46

Sharing

Report Analysis Logs

General

Target

Staffbesting_Private.exe
Size

16.8MB
MD5

454b279d44ee6560e8e2617c86e80c6f
SHA1

092c438dd4f49b090013002086a5a0215a38bc5c
SHA256

84dc07f9e850b5c47ebee63d4262ea9b7fa82a49b01132581b923d19858dc9e8
SHA512

28f2da6ea64f4e6bfee822fbb49e098797cf63361eea56f9357a727f3fa8b07c8f095b59256a688a1f429884ee7366072e5d268cbe2b5ef44cd7fb49ffa5367d
SSDEEP

393216:Tu7L/cxy/m3pqaUX47d4zjO8v/uOMzZlV:TCL0EKqaUI7d4zjO0elV

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2588	Staffbesting_Private.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2588	1964	Staffbesting_Private.exe	30
PID 1964 wrote to memory of 2588	1964	Staffbesting_Private.exe	30
PID 1964 wrote to memory of 2588	1964	Staffbesting_Private.exe	30

C:\Users\Admin\AppData\Local\Temp\Staffbesting_Private.exe
"C:\Users\Admin\AppData\Local\Temp\Staffbesting_Private.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\Staffbesting_Private.exe
  "C:\Users\Admin\AppData\Local\Temp\Staffbesting_Private.exe"
  2⤵
  - Loads dropped DLL
  PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI19642\python311.dll

Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit