1dd9011c7f2faccae6b075e26c6c63977ef29ae1b761e6ba0a2479dc8a3de01e

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 13:41

Target

NitroGift.exe
Size

13.0MB
MD5

4844a731d2261069aef12777f18cf59e
SHA1

2d5a1d27bca288b7488ee8a610283044758fb7d7
SHA256

1dd9011c7f2faccae6b075e26c6c63977ef29ae1b761e6ba0a2479dc8a3de01e
SHA512

10641e034b6f8551f9beb7d34f61e55bfb9b40802c8278561a141ea141c528a98173de99f4b0b95a81f2b386d0f3ee7963e2d9410dabac51918d6b4d0fdfc1f6
SSDEEP

196608:dYfwccBDzf4LBIP6tdQmRJ8dA6lSuVaycBIGpEKo6hTOv+QKf0f4bOUfGlEf07O8:Xcszf490SdQuslSl9DoWOv+9fA4UEf

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2920	NitroGift.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2920	1548	NitroGift.exe	28
PID 1548 wrote to memory of 2920	1548	NitroGift.exe	28
PID 1548 wrote to memory of 2920	1548	NitroGift.exe	28

C:\Users\Admin\AppData\Local\Temp\NitroGift.exe
"C:\Users\Admin\AppData\Local\Temp\NitroGift.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\NitroGift.exe
  "C:\Users\Admin\AppData\Local\Temp\NitroGift.exe"
  2⤵
  - Loads dropped DLL
  PID:2920

C:\Users\Admin\AppData\Local\Temp\_MEI15482\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15482\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit