abff8ad79e497aeb5787012b0b0b718324e98bff7e703071c9fe75d6e534b6d6

Resubmissions

27/11/2024, 13:27

27/11/2024, 09:28

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/11/2024, 09:28

Target
4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe
Size 6.5MB
Sample241127-lfrx3atrgr
SHA256 4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7
MD5 14b6f391b8983ee29eae1b12046198fe
SHA1 7151e86314dc13dbbe1c933e561657a5f0659d8f
SHA512 f40ff4c506f17e9f387921e7c57bf518cc668a3f2bf57a5e71ddab12e17f1bc179d55dcbd2bbfcd6b4d805064e9af6481c54ceb254d203485e52cae9c5c6d5b9
SSDEEP 196608:RXYF+gp1DM9onJ5hrZER9xQ3jo4UR7+OjPw:mpNM9c5hlER9xA2RSOj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1928	4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1928	2656	4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe	32
PID 2656 wrote to memory of 1928	2656	4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe	32
PID 2656 wrote to memory of 1928	2656	4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe	32

C:\Users\Admin\AppData\Local\Temp\4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe
"C:\Users\Admin\AppData\Local\Temp\4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe
  "C:\Users\Admin\AppData\Local\Temp\4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe"
  2⤵
  - Loads dropped DLL
  PID:1928

NitroGenerator.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI26562\NitroGenerator.exe.manifest
Size 1KB
SHA256 0b658718c3b88c7563640c045c7f35936bfdc33d02038e920373eb73f3761a96
MD5 d17be1fcc935fd3c026e1d972dccc2ee
SHA1 8612f7c8f72bc3f65edb84e3152cb12b64073236
SHA512 48011e0c1f0e2a97fbf45a9c1b1629cb52aa9ef9fae55d0806828e70574e8127fd0b4dcccb2aaf55dffacc0556d3ea0c42670aaa225f44381e52cb2c04977c82
MD5 SHA1 SHA512

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26562\python39.dll
Size 4.2MB
SHA256 53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2
MD5 c4b75218b11808db4a04255574b2eb33
SHA1 f4a3497fb6972037fb271cfdc5b404a4b28ccf07
SHA512 0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c
SSDEEP 49152:SEa11VixVQ6TA/cAmVGxvd4mFgERJ4UOjXnRNz4qdA4xyuwxdT/65Oba9gnbq7KQ:qqx6xcGfKzLylZ7MnaHfMJtwV2F
MD5 SHA1 SHA512 SSDEEP

Submit Download