e0051ec0211d9c8090d3a63038d74863094618a8e971ff1efc6ebf939615e8f4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-01-2025 19:34

Target

matcha.exe
Size

7.1MB
MD5

0203b66c50fcda6ab03d559641782548
SHA1

cb83ab81c3d4e86b7adad7f114e6186dfd1e6c72
SHA256

e0051ec0211d9c8090d3a63038d74863094618a8e971ff1efc6ebf939615e8f4
SHA512

38f5dd652c4e9317d4dc52bc8e1408974b0bad17cebe9d6fd82661c881d4c82039d45ae42c4b051aa8a5dc781b4ae4adbbcb7bf52b8c486de3bc99191b669bc7
SSDEEP

98304:9DCIfhvpj/q5MD/x/0feyGgatbQ940BDlgwdnpka9R/k9t+2SzIrzUGt+EtMJbF2:9GOpj/bDfyGgqwBdnpkYRMsc8hJpWR19

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2712	matcha.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2712	2212	matcha.exe	31
PID 2212 wrote to memory of 2712	2212	matcha.exe	31
PID 2212 wrote to memory of 2712	2212	matcha.exe	31

C:\Users\Admin\AppData\Local\Temp\matcha.exe
"C:\Users\Admin\AppData\Local\Temp\matcha.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\matcha.exe
  "C:\Users\Admin\AppData\Local\Temp\matcha.exe"
  2⤵
  - Loads dropped DLL
  PID:2712

C:\Users\Admin\AppData\Local\Temp\_MEI22122\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit