Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/12/2024, 19:47

General

  • Target

    svhost.exe

  • Size

    68.5MB

  • MD5

    bf49d88af5bdfa38697eafe23fd46265

  • SHA1

    3645a8c119a894db4de0a83832eac124062ea92f

  • SHA256

    dd99072b19ece0f1f9c617fa3d07bfe35d7b61468fc8b3d2e3891143442fa1fa

  • SHA512

    07242ef721747979293f58684443e1a1ddc10cc9fda2ef8f2a8764ee1524cfb10edca73b2ea70d34348710a1712b5df9176de65b2c10a7662072fb1dffd95de7

  • SSDEEP

    1572864:l9JfVzrW13CRrrirAH8+1osuTCSxOB6xM5cX72qHWB75iVaN2ZaQ6A:lNECRrS6xjKcBanL2qHO5iV0E

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\svhost.exe
    "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\svhost.exe
      "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
      2⤵
      • Loads dropped DLL
      PID:2912

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\_MEI21562\python312.dll

          Filesize

          6.6MB

          MD5

          f9a43765b486c561bf0895eb9390ed1f

          SHA1

          b398fbd02bd7fdb32dcb88f11758a0a9826b75a4

          SHA256

          3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d

          SHA512

          f2709ba81fe1e01789fc0aae65d31f5adcfd64dd72d161b4cddfa35f91eb2c8d66954925c825b22ce9034fd894ee18500b1ff0a32e4d585491e09d2c540a305c

        • C:\Users\Admin\AppData\Local\Temp\_MEI21562\ucrtbase.dll

          Filesize

          1.1MB

          MD5

          05f2140c1a8a139f2e9866aa2c3166f1

          SHA1

          9170cff11f3b91f552ac09a186a3bae7ea7cda25

          SHA256

          048d4c5a51e45777ba15facdaddbf7702594a2268e8de1768ab0f5f4e4d7e733

          SHA512

          bdc7daf31fa9261967cab58c928fe5146b53c96f9b7c702ae8ee761b2652702d9f34dabf4252b7b580311d6dd4d2914ea7721296bebcea3344006eaa0f99f2ed

        • \Users\Admin\AppData\Local\Temp\_MEI21562\api-ms-win-core-file-l1-2-0.dll

          Filesize

          21KB

          MD5

          a855f5ffc6690c1bd1706d1dae6251a2

          SHA1

          075f84148285a2b61808d3094c8e1fe35466d59f

          SHA256

          98b4b6a29374e68a383bd6e4b58cd76223335d38d2586c5a494466444811b75c

          SHA512

          35ee703d27e15e192a847f86c22ad613880e1e53296a1bc0ae2249b2a777a0bfe3695fd609278281e8b3e5621534a242c3d3a7bda48c7ab23e513b59ceeb889d

        • \Users\Admin\AppData\Local\Temp\_MEI21562\api-ms-win-core-file-l2-1-0.dll

          Filesize

          21KB

          MD5

          18a078bf6941f50fc3158b749441b9ce

          SHA1

          279e944990b2fb184a6d09e3e62f574751e2e9a7

          SHA256

          637e9a34044c366b9b004e62ee15aa4875e344a5a6b7634c803a40d95883d7cc

          SHA512

          bc45590aaa25264e2c9640f5a9a357d6b0cf88e9027fcf70fcad666a50cc309378ce9a49e0d02cdf299b2631b724e863e31061090d6ae7893db048afa6fb6943

        • \Users\Admin\AppData\Local\Temp\_MEI21562\api-ms-win-core-localization-l1-2-0.dll

          Filesize

          21KB

          MD5

          8a52d5f941f257c581e856811586b887

          SHA1

          a510353c67126ec00d13a3f4c0b2e494394a2949

          SHA256

          6ce59c2de64b6195695e8754636cbe283a7af3ddb78acf32c3879d7d09aba4b1

          SHA512

          39bad27e61d9a694740556c8290739780ebd7cfdd1f909b85a37ef5c55bc3bd8f439cb6e26d77715649bb04ae701a02fc789535f0d23a5db9ca4a981a38fcb8e

        • \Users\Admin\AppData\Local\Temp\_MEI21562\api-ms-win-core-processthreads-l1-1-1.dll

          Filesize

          21KB

          MD5

          cb6102cdcd530e82f9a7f2579dd5be22

          SHA1

          8f1881ba356c8d7497580fc5efe2681200632cae

          SHA256

          f5c82a141bdc7929bb3d6d4196c0e8501f4a894fd65a435f8134c073134461ac

          SHA512

          bc9129d58c05991f4567d2ce64e5d5a5ecaa876503ee0644ac61b67fea4b794251cd0f1d1631ef63e8f530a0db074684cde9f35d852ddcb50a9b02d641a63d59

        • \Users\Admin\AppData\Local\Temp\_MEI21562\api-ms-win-core-timezone-l1-1-0.dll

          Filesize

          21KB

          MD5

          7f0a0a190aea88884088bd09d36a2c4b

          SHA1

          f8d3039deda1f7fc025f4e4cbbc3010cba3762b3

          SHA256

          a202f21169cc103c019019d3cbc05c3549a8dbac6eed0ecb4e5281e36f028a26

          SHA512

          5f75ad8016ee9649cd565e27930f951cfc7b40b468ca7a5792578301ff2a16825ca2a98103ba8f4e6d8feb761655be1d8c24fa9e1d539bec6c3a5b3a04f8e9b6