4c3fad8ea837861fe54356ad6e7e40cce2fe305b9cb323f07d8802c93a440b70

Resubmissions

07/10/2024, 18:32

07/10/2024, 18:22

07/10/2024, 18:16

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2024, 18:32

Target
NocturneLoader.exe
Size 607KB
Sample241007-w6nnfavfja
SHA256 4c3fad8ea837861fe54356ad6e7e40cce2fe305b9cb323f07d8802c93a440b70
MD5 4a5b7c6a9592dd295c6c23c6b17eae92
SHA1 538654fa1a9453483ab2d051fad9dfe38cfa2b3e
SHA512 47144a0eac75fb8a4653644441c8f3805e98cf82e681e89288603497ca44b2a43e1c3e794171113bd8744bc712cef31578f0e4f8e54ac029f9613531820ec248
SSDEEP 12288:Cs13XpHNz+8cbkAklsOnb7Ev812q94GEwX/E+:b3XbzzculsObQva91DX8
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5012	NocturneLoader.exe
5012	NocturneLoader.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1196	5012	NocturneLoader.exe	82
PID 5012 wrote to memory of 1196	5012	NocturneLoader.exe	82
PID 1196 wrote to memory of 1552	1196	cmd.exe	83
PID 1196 wrote to memory of 1552	1196	cmd.exe	83
PID 1196 wrote to memory of 4344	1196	cmd.exe	84
PID 1196 wrote to memory of 4344	1196	cmd.exe	84
PID 1196 wrote to memory of 116	1196	cmd.exe	85
PID 1196 wrote to memory of 116	1196	cmd.exe	85