8d347ae2354b8e5e89fe1423c55b67d7d3b27f280b71187c89cc3a6b62ee74ff

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/02/2025, 12:08

Target

NexusFiveM/NexusFiveM.exe
Size

7.6MB
MD5

4e4b715046fa491f2566949a8323fb78
SHA1

335060ed70f4ee3471cd2ddce245e57e623e109a
SHA256

8d847a8e298457cd0f8f249457ee75ca62f1a73a39a0748841eda05eb99f8fcf
SHA512

9970f79ddc60a7bcd14c0de9f56091fd0d7033f533774f728a1cf1ceef15e9cebb3a7777b9ad17c5ce3fd12ec9bcd80d7fbdc387f279743af87d6d0fa8077845
SSDEEP

196608:TLRgFWwfI9jUC2gYBYv3vbWY+iITm1U6fd1Ed:PyFdIH2gYBgDW/TOzb6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2684	NexusFiveM.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001950c-21.dat	upx
behavioral1/memory/2684-23-0x000007FEF64E0000-0x000007FEF6BA5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2684	2144	NexusFiveM.exe	30
PID 2144 wrote to memory of 2684	2144	NexusFiveM.exe	30
PID 2144 wrote to memory of 2684	2144	NexusFiveM.exe	30

C:\Users\Admin\AppData\Local\Temp\NexusFiveM\NexusFiveM.exe
"C:\Users\Admin\AppData\Local\Temp\NexusFiveM\NexusFiveM.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\Temp\NexusFiveM\NexusFiveM.exe
  "C:\Users\Admin\AppData\Local\Temp\NexusFiveM\NexusFiveM.exe"
  2⤵
  - Loads dropped DLL
  PID:2684

C:\Users\Admin\AppData\Local\Temp\_MEI21442\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2684-23-0x000007FEF64E0000-0x000007FEF6BA5000-memory.dmp

Filesize
6.8MB

Download