44000c80effa84d7b149003e07b9c73ebfdb73f21672f6beee69f6a298c226fb | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 00:34

Sharing

Report Analysis Logs

General

Target

generated_script.exe
Size

56.0MB
MD5

0743d55a94100e93c80e9ad6201f7f60
SHA1

2e8ad959c55b407bd67a8cb88e93f3cd670cc1af
SHA256

44000c80effa84d7b149003e07b9c73ebfdb73f21672f6beee69f6a298c226fb
SHA512

4b69c923f9ffca887c1dc4904864015ca1e3e8dd05b828b4830acf7b1e349cf3260b82db0c601658fe6732aed622614a3a1d2353555e42d906c49e97879afacc
SSDEEP

196608:8mKu818v8SYdQmRm8Qnf2ODjMnGydS8GrNs:mu81olYdQdF3MnG38GrNs

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2320	generated_script.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2320	2236	generated_script.exe	30
PID 2236 wrote to memory of 2320	2236	generated_script.exe	30
PID 2236 wrote to memory of 2320	2236	generated_script.exe	30

C:\Users\Admin\AppData\Local\Temp\generated_script.exe
"C:\Users\Admin\AppData\Local\Temp\generated_script.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\generated_script.exe
  "C:\Users\Admin\AppData\Local\Temp\generated_script.exe"
  2⤵
  - Loads dropped DLL
  PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI22362\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit