7fd20dd1ce4c8e54f077ef9880dd8794158fc2406d66b7656e239f798eacfeee

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 14:32

Target

Nuker 1.2.exe
Size

6.0MB
MD5

ea52bb50895e85eba81d29a84318cb62
SHA1

198d852c2baf2304e44da82e4ba74d591cf31776
SHA256

7fd20dd1ce4c8e54f077ef9880dd8794158fc2406d66b7656e239f798eacfeee
SHA512

8bbc5061f167f36deea84a909e1df87ac67a53e04195874f6892b73b37a0a79285ed945ae509972721a85c0df1cf5207486978ba870965810d9de8014e87f0f7
SSDEEP

98304:UAmoDUN43W5NjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6ag1Rjtj4:UAumWDOjmFwDRxtYSHdK34kdai7bN3mz

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
892	Nuker 1.2.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195c0-22.dat	upx
behavioral1/memory/892-24-0x000007FEF53B0000-0x000007FEF5816000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 892	1504	Nuker 1.2.exe	30
PID 1504 wrote to memory of 892	1504	Nuker 1.2.exe	30
PID 1504 wrote to memory of 892	1504	Nuker 1.2.exe	30

C:\Users\Admin\AppData\Local\Temp\Nuker 1.2.exe
"C:\Users\Admin\AppData\Local\Temp\Nuker 1.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\Nuker 1.2.exe
  "C:\Users\Admin\AppData\Local\Temp\Nuker 1.2.exe"
  2⤵
  - Loads dropped DLL
  PID:892

C:\Users\Admin\AppData\Local\Temp\_MEI15042\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/892-24-0x000007FEF53B0000-0x000007FEF5816000-memory.dmp

Filesize
4.4MB

Download