e11811051baa4b8010aa790f6f1e86e7275647a70901a31e30b20140a635bb9e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 00:11

Target

OnajNitroV1.exe
Size

6.4MB
MD5

ee518bb6425bdb8ab369d78ced89bd9d
SHA1

ba54b1c5882311c342474434589d0be7460b3e26
SHA256

e11811051baa4b8010aa790f6f1e86e7275647a70901a31e30b20140a635bb9e
SHA512

af9903309f8785aedd31750115d0075ccde4e25ee79ccf24fb56c9511b664a60d78e3a2f911d263aec18890391128d38d45d3955029a0e7db08542bd5981a09a
SSDEEP

98304:k1SPf3FHkDx6hzb71QGQCPDbZfzuOqV6l7ayCb7BJ5mjwNwwMeZYobSr+h+I0x1:k1cflkMFdQmRrdA6l7aycBIGpEoNT

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2956	OnajNitroV1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2956	2004	OnajNitroV1.exe	29
PID 2004 wrote to memory of 2956	2004	OnajNitroV1.exe	29
PID 2004 wrote to memory of 2956	2004	OnajNitroV1.exe	29

C:\Users\Admin\AppData\Local\Temp\OnajNitroV1.exe
"C:\Users\Admin\AppData\Local\Temp\OnajNitroV1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\OnajNitroV1.exe
  "C:\Users\Admin\AppData\Local\Temp\OnajNitroV1.exe"
  2⤵
  - Loads dropped DLL
  PID:2956

C:\Users\Admin\AppData\Local\Temp\_MEI20042\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit