907667d4817b5d6d14c6dcf985846d694f15ff0c2ce222706724917b2a9a61e3

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 18:14

Target

IROX.exe
Size

11.9MB
MD5

1b939044c83d581d9315af108e3850b7
SHA1

0f48d47102bbab243787179f744bcf9e9a6956f1
SHA256

907667d4817b5d6d14c6dcf985846d694f15ff0c2ce222706724917b2a9a61e3
SHA512

ad2f67f22657db6f3d037d29e2d116dfd9e98da060be85be61ccce22a0639792267ebf0c0fd810fde689729362a5da2545eab73a17999cc964b759cab9fa538c
SSDEEP

196608:+K2QY2an1SULDfyGlW21X5Sp6GemDMPwYWtvwYlB9X0/bClL171s7aLkzQPhBy1:hY2afLDfDllpfaMPiF9EMJ+7aYsy1

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

IROX.exe

pid process

2700 IROX.exe
Suspicious use of WriteProcessMemory 3 IoCs

Processes:

IROX.exe

description pid process target process

PID 2944 wrote to memory of 2700 2944 IROX.exe IROX.exe
PID 2944 wrote to memory of 2700 2944 IROX.exe IROX.exe
PID 2944 wrote to memory of 2700 2944 IROX.exe IROX.exe

pid	process
2700	IROX.exe

description	pid	process	target process
PID 2944 wrote to memory of 2700	2944	IROX.exe	IROX.exe
PID 2944 wrote to memory of 2700	2944	IROX.exe	IROX.exe
PID 2944 wrote to memory of 2700	2944	IROX.exe	IROX.exe

C:\Users\Admin\AppData\Local\Temp\IROX.exe
"C:\Users\Admin\AppData\Local\Temp\IROX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944

C:\Users\Admin\AppData\Local\Temp\IROX.exe
"C:\Users\Admin\AppData\Local\Temp\IROX.exe"
2⤵
- Loads dropped DLL
PID:2700

C:\Users\Admin\AppData\Local\Temp\_MEI29442\python311.dll
Filesize
5.5MB

MD5
e2bd5ae53427f193b42d64b8e9bf1943

SHA1
7c317aad8e2b24c08d3b8b3fba16dd537411727f

SHA256
c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400

SHA512
ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036

Download Submit