d4623aa5c9eca7022b5ece7aadb8ff7cce006be9c7623aaa3e41ad6015f18839

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 07:32

Target

nexia.exe
Size

1.6MB
MD5

97a1bc1a742b216b6c6eeea5d09cdbf7
SHA1

be6c1c0b6d78b64fdcb50a811b73e9ffb957b6e8
SHA256

d4623aa5c9eca7022b5ece7aadb8ff7cce006be9c7623aaa3e41ad6015f18839
SHA512

76f343296de1d450ccc6011e55d625856f6e16c4a5d0299da26205d16805988c4aca62e5a5a34f47cc0039b94d18c4fdb1f0d444ca59be08309e15abe9bf54c8
SSDEEP

24576:n2sR+LFlTaGqCRBU6ScNmUbVgSw9MztH9g4dZdVoUne3v8LbwfnkKT7:2sR+LLJocNyh9MN9ZvoUe3v8snV

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2684	2372	nexia.exe	31
PID 2372 wrote to memory of 2684	2372	nexia.exe	31
PID 2372 wrote to memory of 2684	2372	nexia.exe	31
PID 2684 wrote to memory of 2792	2684	cmd.exe	32
PID 2684 wrote to memory of 2792	2684	cmd.exe	32
PID 2684 wrote to memory of 2792	2684	cmd.exe	32
PID 2684 wrote to memory of 2808	2684	cmd.exe	33
PID 2684 wrote to memory of 2808	2684	cmd.exe	33
PID 2684 wrote to memory of 2808	2684	cmd.exe	33
PID 2684 wrote to memory of 2788	2684	cmd.exe	34
PID 2684 wrote to memory of 2788	2684	cmd.exe	34
PID 2684 wrote to memory of 2788	2684	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\nexia.exe
"C:\Users\Admin\AppData\Local\Temp\nexia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\nexia.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\nexia.exe" MD5
    3⤵
    PID:2792
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2808
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2788