8a714538823fc5e4cdbec6114c6d30fe3ab2eb2b557b81de4c59e073c85aa765

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 20:21

Target

NSFW Generator/start.bat
Size

17B
MD5

7832b275978713ff3c40544308894cda
SHA1

981608258b7ca6860bc90981321716d167884302
SHA256

fa52f3a6d700af1047bd644f48985baa147256b612cc0751968cc3e0715c69c1
SHA512

d77c0216f1a4e7dae6b417c3c1e3339fce4cf30b112dc8251011ebb82ad489b2366e71699323af14e72c96a4793fc5bb86a22b6bb723d2302cf5e6712a3cac85

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
596	NSFWGEN.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1040	2240	cmd.exe	31
PID 2240 wrote to memory of 1040	2240	cmd.exe	31
PID 2240 wrote to memory of 1040	2240	cmd.exe	31
PID 1040 wrote to memory of 596	1040	NSFWGEN.exe	32
PID 1040 wrote to memory of 596	1040	NSFWGEN.exe	32
PID 1040 wrote to memory of 596	1040	NSFWGEN.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\NSFW Generator\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\NSFW Generator\NSFWGEN.exe
  NSFWGEN.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Users\Admin\AppData\Local\Temp\NSFW Generator\NSFWGEN.exe
    NSFWGEN.exe
    3⤵
    - Loads dropped DLL
    PID:596

C:\Users\Admin\AppData\Local\Temp\_MEI10402\python312.dll

Filesize
1.2MB

MD5
52184c8ede384121878fa1ad7e4208d9

SHA1
1bf89ee92344f9814518024d14bdbc5da7318d27

SHA256
87d372f932cdc4037120b6afb472595043ddcc09b359668d09d8394bb432c05c

SHA512
afb5c3d51d23f696d10bf576ff86e9c8e47328f0dabb03ffedfd3a99ba0404851ca31c6a302268156a260d699351816d5cf632e3a54a7e1e2cdb454815e2c3da

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10402\python312.dll

Filesize
3.5MB

MD5
757de56bc085d2c89c6aecd6e93a7203

SHA1
027fc65c54d6181210b532a48f32fbfc4cc0cadd

SHA256
d6b617d104a756e840cd17d1142e96fbb25559e78063fdbea86e61fcfb59cceb

SHA512
6cb1e68ec50699f077a4053c6dd8d16b36b6dfa2d2360879b741e344bfbfaa46d918e65f2dd64f5e6b8291e812422433a2468eed518e9494b62a82ef5ecfb28e

Download Submit