b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:26

Target

Nezur V2.exe
Size

6.9MB
MD5

26a8bb47cefbd6bab1cb10c5108f4b67
SHA1

88fc651574d643e129342afbf3f6d5794963dbff
SHA256

b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b
SHA512

0ef1927973273a33c4847966945e396735bb373cb902e6f327ea7cb10573f9d99393b1efddf67d16adc55d4809f7efa03bfb3b4f6018d53e3234e3d2d099cfaf
SSDEEP

98304:lRazHqdVfB2FS27wGcyuT/9vUIdD9C+z3zO917vOTh+ezDNh7ovmJ1nmOBN9n4mR:lAQsNcbT/9bvLz3S1bA3zNn97zJV

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2196	Nezur V2.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000015018-21.dat	upx
behavioral1/files/0x0006000000015018-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2196	3044	Nezur V2.exe	19
PID 3044 wrote to memory of 2196	3044	Nezur V2.exe	19
PID 3044 wrote to memory of 2196	3044	Nezur V2.exe	19

C:\Users\Admin\AppData\Local\Temp\Nezur V2.exe
"C:\Users\Admin\AppData\Local\Temp\Nezur V2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\Nezur V2.exe
  "C:\Users\Admin\AppData\Local\Temp\Nezur V2.exe"
  2⤵
  - Loads dropped DLL
  PID:2196

C:\Users\Admin\AppData\Local\Temp\_MEI30442\python311.dll

Filesize
1.1MB

MD5
b2c082dec3e16d5efdbac6288667b837

SHA1
be4baad95e330be199ccbad3195a630c7ad9f715

SHA256
d0966b7ff27d8be9d19892fe848514a505a35f11eeb1458fec0dc9dfd1e9f761

SHA512
d1271d77b9ee185c5c39bae891feb71a4e32fc64e477ecc6fda13f940e9dd64811a9ccc7d128db7616f3fde5a3afd9acfef026e87d97356f45de95b71e551802

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30442\python311.dll

Filesize
752KB

MD5
79188c54efc9d82ea81a7a0c7dd743da

SHA1
4edca15be1741ed3bf7d953f05dfe8e368a9ca40

SHA256
e62dec1f62d7ef10476840ff6cf59d61aa3787f55debdfeb4497c9dbf07cb6e2

SHA512
df38ef1347fec8d67fdb8598e7782f5b632bfb75738bc956101f94175e735f1a62a21afd0434145d91f12e990f4953a9f881899d0f0643e09c773ec0867074eb

Download Submit
memory/2196-23-0x000007FEF65B0000-0x000007FEF6B99000-memory.dmp

Filesize
5.9MB

Download