4c012852b1f874922730c7b45fed0e2b8bd9566d8ae13c1c4222a7addc3b92da | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/03/2025, 16:22

Sharing

Report Analysis Logs

General

Target

Colorbotwritteninpy.exe
Size

14.6MB
MD5

897276fc553709ef67a4c17cef5f0b80
SHA1

446f651bf0f1f20d71c145c6661cd2a308d7b8f6
SHA256

4c012852b1f874922730c7b45fed0e2b8bd9566d8ae13c1c4222a7addc3b92da
SHA512

3bf62309025aed6803c606193bdffa7abf4d6376c9b2d41209d11a08fc4202f82e644a006f22da06d054d2669bcefbfbf7108860ccec38972dafb6e05406f4da
SSDEEP

393216:19Yi2Vlj87d9gdQuslSq9VoWOv+9fSZk1vwUrjLP2:19Yi2Vl8Z+dQuSTorvSKSFwUnLP2

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2616	Colorbotwritteninpy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 2616	236	Colorbotwritteninpy.exe	30
PID 236 wrote to memory of 2616	236	Colorbotwritteninpy.exe	30
PID 236 wrote to memory of 2616	236	Colorbotwritteninpy.exe	30

C:\Users\Admin\AppData\Local\Temp\Colorbotwritteninpy.exe
"C:\Users\Admin\AppData\Local\Temp\Colorbotwritteninpy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:236
- C:\Users\Admin\AppData\Local\Temp\Colorbotwritteninpy.exe
  "C:\Users\Admin\AppData\Local\Temp\Colorbotwritteninpy.exe"
  2⤵
  - Loads dropped DLL
  PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI2362\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit