f16a87e183bfe34afc75098a027d9397bf97a8fd2d289abe723d628072602b3c

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 12:47

Target

Discord_Nitro_Generator.exe
Size

10.3MB
MD5

deb8e6b240f3fe4f14717f270bc7d72b
SHA1

454d0cc939a7c45fcd38f2a10a6fe025d8c2a1ba
SHA256

f16a87e183bfe34afc75098a027d9397bf97a8fd2d289abe723d628072602b3c
SHA512

cd3da01d3305e722cec703e4e7a5581ca1e73a6f8a6133ed0fb8e4a2a8c619dd719ce390f8fce142b1a06171f9576d679c80b19b099e306d2ea2a69a9aee6b83
SSDEEP

196608:SDf+GIzme9onJ5hrZERlyiU8AdZYJERS48RmU/3ZlsPvarTsZg8CNhHSzCqblZou:JPzJ9c5hlERJAdZYygtN3ZWarQcHSl6

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2840	Discord_Nitro_Generator.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2840	2020	Discord_Nitro_Generator.exe	29
PID 2020 wrote to memory of 2840	2020	Discord_Nitro_Generator.exe	29
PID 2020 wrote to memory of 2840	2020	Discord_Nitro_Generator.exe	29

C:\Users\Admin\AppData\Local\Temp\Discord_Nitro_Generator.exe
"C:\Users\Admin\AppData\Local\Temp\Discord_Nitro_Generator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\Discord_Nitro_Generator.exe
  "C:\Users\Admin\AppData\Local\Temp\Discord_Nitro_Generator.exe"
  2⤵
  - Loads dropped DLL
  PID:2840

C:\Users\Admin\AppData\Local\Temp\_MEI20202\file.exe.manifest

Filesize
1KB

MD5
9d75af9a23adce751bb9a632ef96850f

SHA1
e3b6b477616d122909e2f82c123be099d48a20ed

SHA256
ba5c9a4c0311f9768153150df44fcbda10f13b0706e018840b104f305625f06c

SHA512
b99122b01dc144ddb0deb2cfe356be58f95cf2d6edd45e3b80fd54bccd922aa72303717517bde6e948bee4178ab34bcb8f0f612ba88812b0fda531f91a8ae64c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20202\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20202\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit