e3b0ab45f40a99bcfec631868debf25f8736fe7409579fc53ecad859571ac721

Analysis

max time kernel
24s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-02-2023 10:50

Target

nimrod3k_beta.exe
Size

113.7MB
MD5

3ad89fefa1ad157633127240c3391ea0
SHA1

a782cd2f64d83a427a1f3518ccf0ecb318dc1494
SHA256

e3b0ab45f40a99bcfec631868debf25f8736fe7409579fc53ecad859571ac721
SHA512

1daacfcfc7d93d7fc9c730abc7bd6220f3585502af74add7f32713bda4f199666f2705ead4efb63b686cbce5ed5b65223b013c26930c678b5c128756b1842f52
SSDEEP

3145728:/F7V7SC++pLwANp7y4NT/LjBCVpOmo8sLOEc+:pVWCXPjrBc0mMOE

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

nimrod3k_beta.exe

pid process

2036 nimrod3k_beta.exe

pid	process
2036	nimrod3k_beta.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

nimrod3k_beta.exe

description	pid	process	target process
PID 1244 wrote to memory of 2036	1244	nimrod3k_beta.exe	nimrod3k_beta.exe
PID 1244 wrote to memory of 2036	1244	nimrod3k_beta.exe	nimrod3k_beta.exe
PID 1244 wrote to memory of 2036	1244	nimrod3k_beta.exe	nimrod3k_beta.exe

C:\Users\Admin\AppData\Local\Temp\nimrod3k_beta.exe
"C:\Users\Admin\AppData\Local\Temp\nimrod3k_beta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\nimrod3k_beta.exe
"C:\Users\Admin\AppData\Local\Temp\nimrod3k_beta.exe"
2⤵
- Loads dropped DLL
PID:2036

C:\Users\Admin\AppData\Local\Temp\_MEI12442\python311.dll
Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12442\python311.dll
Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
memory/2036-54-0x0000000000000000-mapping.dmp

Download