0acf9a31d3fbee46692c4a92d867038b6296d72b7d1d24b986d3f558e4cb7c90

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 23:02

Target

NNLoader.exe
Size

9.4MB
MD5

4ed456dfa36635dabf31d6571c53362f
SHA1

e6cd5d7271f99d04b90736e3e5defd0988f3103b
SHA256

0acf9a31d3fbee46692c4a92d867038b6296d72b7d1d24b986d3f558e4cb7c90
SHA512

337bdf3daa2ee09e2ffac24f549faa9e770bc3938062b5d88eaf2accfc10e9e098c8c7e55a16d4b3316e186b2ae1bb46868aa05c6b1c7b6abc17468c41f0fd15
SSDEEP

196608:kTPCeRqxlEAtJb3tQk5tARHvUWvo3hxjno/w3iFCxHQbRpXJBz23:Hnt7v5tARHdgxro/w3uCxHQb5Z2

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2788	NNLoader.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4c5-45.dat	upx
behavioral1/memory/2788-47-0x000007FEF68A0000-0x000007FEF6D05000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2788	2380	NNLoader.exe	29
PID 2380 wrote to memory of 2788	2380	NNLoader.exe	29
PID 2380 wrote to memory of 2788	2380	NNLoader.exe	29

C:\Users\Admin\AppData\Local\Temp\NNLoader.exe
"C:\Users\Admin\AppData\Local\Temp\NNLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\NNLoader.exe
  "C:\Users\Admin\AppData\Local\Temp\NNLoader.exe"
  2⤵
  - Loads dropped DLL
  PID:2788

C:\Users\Admin\AppData\Local\Temp\_MEI23802\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2788-47-0x000007FEF68A0000-0x000007FEF6D05000-memory.dmp

Filesize
4.4MB

Download