cc16442e6554b7001f4d23d1782dfd5a6836df2c2dc8e409dda921ea3ae8cb93

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 16:56

Target

nitrogen.exe
Size

5.8MB
MD5

6c54a9ec65d3040ba46c5d3f1b3faede
SHA1

28fa5ec10f34d29b7eb02664e64f6d8f72120874
SHA256

cc16442e6554b7001f4d23d1782dfd5a6836df2c2dc8e409dda921ea3ae8cb93
SHA512

3f26c79bd10b4c4ea9279222186e0a731dfd50ddda22530d4092461e05ea1988364b865ee50ff2260c4eb06adf6ef18765e4e56f4d19c62be425bfe653a040e8
SSDEEP

98304:IrrwmDSuXXO8RHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nuL:IrrwmDZ7RHvUWvozWOxu9kXwvdbDlA06

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2548	nitrogen.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019bf6-21.dat	upx
behavioral1/memory/2548-23-0x000007FEF6A30000-0x000007FEF6E9A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2548	1048	nitrogen.exe	29
PID 1048 wrote to memory of 2548	1048	nitrogen.exe	29
PID 1048 wrote to memory of 2548	1048	nitrogen.exe	29

C:\Users\Admin\AppData\Local\Temp\nitrogen.exe
"C:\Users\Admin\AppData\Local\Temp\nitrogen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\nitrogen.exe
  "C:\Users\Admin\AppData\Local\Temp\nitrogen.exe"
  2⤵
  - Loads dropped DLL
  PID:2548

C:\Users\Admin\AppData\Local\Temp\_MEI10482\python310.dll

Filesize
1.4MB

MD5
b3ae142a88ff3760a852ba7facb901bc

SHA1
ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

SHA256
2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

SHA512
3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

Download Submit
memory/2548-23-0x000007FEF6A30000-0x000007FEF6E9A000-memory.dmp

Filesize
4.4MB

Download