eacbb5f16c8e1315bfa69d3bb0ce318cf246cff642bbde43e6263fd34e0c399b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 15:46

Target

NukeTooldiscord-gg-kasyno.exe
Size

42.5MB
MD5

51817b9dcd9c193c3358f6b179d268d1
SHA1

48711e49dd33723c12a2ba925d228b99ab297274
SHA256

eacbb5f16c8e1315bfa69d3bb0ce318cf246cff642bbde43e6263fd34e0c399b
SHA512

6a5b1ac87137fe7ced1c902ee331d2eaf38a6d042b836190abd1a6a9f3826e1141c86ab64557992e7c388278f81f8abd04e60027e790cad8713c374f920f6957
SSDEEP

786432:gDEDi+G9pN2TxKFLyPnoVIXkXVGRG7dcuZaqdior4XXpf6q3loaU/fsc+KkeAhev:ggDi+RoFLyPno/AydcucZfb3KnqKUhev

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3032	NukeTooldiscord-gg-kasyno.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001878c-22.dat	upx
behavioral1/memory/3032-24-0x000007FEF5D40000-0x000007FEF61A6000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3032	1144	NukeTooldiscord-gg-kasyno.exe	30
PID 1144 wrote to memory of 3032	1144	NukeTooldiscord-gg-kasyno.exe	30
PID 1144 wrote to memory of 3032	1144	NukeTooldiscord-gg-kasyno.exe	30

C:\Users\Admin\AppData\Local\Temp\NukeTooldiscord-gg-kasyno.exe
"C:\Users\Admin\AppData\Local\Temp\NukeTooldiscord-gg-kasyno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\NukeTooldiscord-gg-kasyno.exe
  "C:\Users\Admin\AppData\Local\Temp\NukeTooldiscord-gg-kasyno.exe"
  2⤵
  - Loads dropped DLL
  PID:3032

C:\Users\Admin\AppData\Local\Temp\_MEI11442\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/3032-24-0x000007FEF5D40000-0x000007FEF61A6000-memory.dmp

Filesize
4.4MB

Download