4ef68e3dc9748d50c7df66349d324ab972cb313645492c192809648e1e563737

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-11-2024 21:45

Target

Nexar.exe
Size

7.6MB
MD5

e79f13238418281f91b9060e58020bac
SHA1

bef9b4abb0e779c1a8519f731e2433156372f2ba
SHA256

4ef68e3dc9748d50c7df66349d324ab972cb313645492c192809648e1e563737
SHA512

d77dbeb4c6c65c5667bcb5699f8e4389b66f9e21be125266c516c08277f5664211c3ee7ad18dc0d92dd78b67011eb226e95d54ca69d8d4e1ca9e1ddeb9c890b3
SSDEEP

196608:iIgVVE9GwfI9jUC2gYBYv3vbW2+iITx1U6n4:GVVE9tIH2gYBgDWJTnz4

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2576	Nexar.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000018c34-21.dat	upx
behavioral1/memory/2576-23-0x000007FEF6480000-0x000007FEF6B45000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2576	2716	Nexar.exe	30
PID 2716 wrote to memory of 2576	2716	Nexar.exe	30
PID 2716 wrote to memory of 2576	2716	Nexar.exe	30

C:\Users\Admin\AppData\Local\Temp\Nexar.exe
"C:\Users\Admin\AppData\Local\Temp\Nexar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\Nexar.exe
  "C:\Users\Admin\AppData\Local\Temp\Nexar.exe"
  2⤵
  - Loads dropped DLL
  PID:2576

C:\Users\Admin\AppData\Local\Temp\_MEI27162\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2576-23-0x000007FEF6480000-0x000007FEF6B45000-memory.dmp

Filesize
6.8MB

Download