40d3db4f7a657dd55aff0ddeab025f6d996ae7358c241b6ac5158d35235b90cd

Analysis

max time kernel
841s
max time network
848s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/01/2025, 22:50

Target

ReBomb2-main/ReBomb2.exe
Size

8.7MB
MD5

1ee2da669f0f36a4b84d994a77ed3f38
SHA1

6262d47dd5764352b48b6117fbc0e2744e4b5336
SHA256

2b48ca27d73a56ec7884e2e3223315c328f00d177662ff157993544944f0557e
SHA512

4f523b67e4a4bb3f9f0f28547990775deba430e317ba9a62ea31a0154d130cd9dc4b1d92c69e71b2427223ae5ab0865c9c488d9444211cb51f6e80bbc51d38b0
SSDEEP

196608:kTDNAQn/RNrlHAjoG+I1qpR1Ix89dyyVWY14DJDA+xmF5RzZ57:QO4ZxlHOF4FIx2cyVfCtM+xS5R

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2636	ReBomb2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2636	1048	ReBomb2.exe	29
PID 1048 wrote to memory of 2636	1048	ReBomb2.exe	29
PID 1048 wrote to memory of 2636	1048	ReBomb2.exe	29

C:\Users\Admin\AppData\Local\Temp\ReBomb2-main\ReBomb2.exe
"C:\Users\Admin\AppData\Local\Temp\ReBomb2-main\ReBomb2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\ReBomb2-main\ReBomb2.exe
  "C:\Users\Admin\AppData\Local\Temp\ReBomb2-main\ReBomb2.exe"
  2⤵
  - Loads dropped DLL
  PID:2636

C:\Users\Admin\AppData\Local\Temp\_MEI10482\python39.dll

Filesize
4.3MB

MD5
d4bed68bb58d08a26c67214447cbc6ee

SHA1
c4cd63967a816bbe76888fdd95586a0911900fda

SHA256
6e67838ad7e50e8cc71e489a723613b25795c7079295778e724573f411295067

SHA512
8a49979c6fd1f00ba96bdb6762bbecfc6e836b469de39381c47e4f05ddc206d2a001d5c8175fafdc16d3152baba9078faeecfbcfa8222e31b018a93c7dd3d168

Download Submit