80ba9c55c52d61fe8851472d1c4d27fed29438e941a3f9bfc0175cbd2e4b7604 | Triage

Resubmissions

28/03/2025, 18:45

250328-xd3gka1qw3 7

28/03/2025, 18:44

250328-xdxlbazvdt 7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 18:45

Sharing

Report Analysis Logs

General

Target

main.exe
Size

9.7MB
MD5

9551ff0bf70fefafd814269694b14e9b
SHA1

3e9bb95551052db9e83cf6f6657b4042d266057b
SHA256

80ba9c55c52d61fe8851472d1c4d27fed29438e941a3f9bfc0175cbd2e4b7604
SHA512

1cedc703bb80dbeec750a977d79c3f2441978fbc9a2a25f0c9549efb240f5d2dc8a2ac18d345216b8a1f59e60bc59496a29253295c97d640e3e4f1221b240472
SSDEEP

196608:Xv8ZdxEz2dQmR8dA6lEA8Qnf2ODjMnGydS8Hy8CKPrNBWORWKD3RmKHy:fqdO2dQJlEIF3MnG38PVPrrWM73dH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2868	main.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2868	2112	main.exe	31
PID 2112 wrote to memory of 2868	2112	main.exe	31
PID 2112 wrote to memory of 2868	2112	main.exe	31

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Loads dropped DLL
  PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI21122\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit