60dd8814d409e4ce28bf068df0982a3ab82549f40589da218af79a47be93078c

Analysis

Target

AveryNuker.exe
Size

12.0MB
MD5

24872cd671d2f790c51567cb2f5102be
SHA1

e8b03b5ac222e382af70d31c839f97510e2cd277
SHA256

60dd8814d409e4ce28bf068df0982a3ab82549f40589da218af79a47be93078c
SHA512

e8e3967ca8d47f05cf4bb21afed0ca8a48dee51e9a40648c61327e5bd0d4f5a09e53bc4a03780a3f636497c8de8505f851f9f0bcb755f0a3ddf1dafa43a8a078

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

AveryNuker.exe

pid process

1588 AveryNuker.exe

pid	process
1588	AveryNuker.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

AveryNuker.exe

description	pid	process	target process
PID 472 wrote to memory of 1588	472	AveryNuker.exe	AveryNuker.exe
PID 472 wrote to memory of 1588	472	AveryNuker.exe	AveryNuker.exe
PID 472 wrote to memory of 1588	472	AveryNuker.exe	AveryNuker.exe

C:\Users\Admin\AppData\Local\Temp\AveryNuker.exe
"C:\Users\Admin\AppData\Local\Temp\AveryNuker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:472

C:\Users\Admin\AppData\Local\Temp\AveryNuker.exe
"C:\Users\Admin\AppData\Local\Temp\AveryNuker.exe"
2⤵
- Loads dropped DLL
PID:1588

C:\Users\Admin\AppData\Local\Temp\_MEI4722\python39.dll
MD5
64fde73c54618af1854a51db302192fe

SHA1
c5580dcea411bfed2d969551e8089aab8285a1d8

SHA256
d44753fe884b228da36acb17c879b500aeb0225a38fb7ca142fb046c60b22204

SHA512
a7d368301a27ee07a542e45e9ad27683707979fb198b887b66b523609f69e3327d4b77b7edc988c73a4fe26c44bff3abfcd032a991cd730fd8e0de2dad2e3a06

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI4722\python39.dll
MD5
64fde73c54618af1854a51db302192fe

SHA1
c5580dcea411bfed2d969551e8089aab8285a1d8

SHA256
d44753fe884b228da36acb17c879b500aeb0225a38fb7ca142fb046c60b22204

SHA512
a7d368301a27ee07a542e45e9ad27683707979fb198b887b66b523609f69e3327d4b77b7edc988c73a4fe26c44bff3abfcd032a991cd730fd8e0de2dad2e3a06

Download Submit
memory/1588-54-0x0000000000000000-mapping.dmp

Download