b36214dc2f88734f64053a587d5e958cb4465025ec152a31311b2bf437f08735

Resubmissions

28-10-2024 21:12

28-10-2024 21:05

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 21:05

Target

DiscordNitroGenbyCybo.exe
Size

12.7MB
MD5

0c42c2031a47e510c4bb51a194f07d7d
SHA1

ec8f62c943996c7d6b46447093810a1594d69df9
SHA256

b36214dc2f88734f64053a587d5e958cb4465025ec152a31311b2bf437f08735
SHA512

dae80d0d4145bc641052352877dd03c605b218d3918bb01540f6201beadd19d07576c64f374fa54aa2184a6b5b9b92805046aa082d8e6bfc114fa7143423e87f
SSDEEP

196608:rEdpbKrulBKd2G1cMczyYUNYPyzcFgXft7Q/6odBFFC6j8dkkSmKyXNdaFjsTPIk:QpOruRG6lUNU76t0/TBFj8+tmPPaqk

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

DiscordNitroGenbyCybo.exe

pid	Process
2736	DiscordNitroGenbyCybo.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x000500000001a4a9-78.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DiscordNitroGenbyCybo.exe

description	pid	Process	procid_target
PID 2580 wrote to memory of 2736	2580	DiscordNitroGenbyCybo.exe	29
PID 2580 wrote to memory of 2736	2580	DiscordNitroGenbyCybo.exe	29
PID 2580 wrote to memory of 2736	2580	DiscordNitroGenbyCybo.exe	29

C:\Users\Admin\AppData\Local\Temp\DiscordNitroGenbyCybo.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordNitroGenbyCybo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\DiscordNitroGenbyCybo.exe
  "C:\Users\Admin\AppData\Local\Temp\DiscordNitroGenbyCybo.exe"
  2⤵
  - Loads dropped DLL
  PID:2736

C:\Users\Admin\AppData\Local\Temp\_MEI25802\python39.dll

Filesize
1.4MB

MD5
4347cdf525c811976988f15323967e7b

SHA1
3cb22b3fb1fbba89393a7d0dfeb781e480641cad

SHA256
5a46ac07f776f7f7224af22426af3955f23fc2136246a67418f6e2f33672d74f

SHA512
09f499315d2b918ece9bcf07887bd158011a3c4e5adea769f986cb8f981ef25a6af82ffb1b59c2f3db329401144585c469db81906b86072c69ffb7fb2b7909ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25802\setuptools-49.2.1.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
memory/2736-80-0x000007FEF7170000-0x000007FEF75F1000-memory.dmp

Filesize
4.5MB

Download