6ff7aedc498bef729553eafea78e4a5d498d52837f45c7c188d51cfaab10c2f9

Analysis

Target

Setup_WinThruster_2022.exe
Size

6.2MB
MD5

3a7e7ea1cf919179c78d9c1984954703
SHA1

e31ad15a0da3eb8da66cf41f7c867e5321a112ef
SHA256

6ff7aedc498bef729553eafea78e4a5d498d52837f45c7c188d51cfaab10c2f9
SHA512

c49c7c9fc88370ed88880bc2dcd2d24f611f2b96ebf9749600e7edfe563f06c8c3686a3fb6a4fa33ee9ade61ca8f79ba5a3372cfa2dcefad4a02af80687d46e2

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1316	Setup_WinThruster_2022.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1316	4416	Setup_WinThruster_2022.exe	83
PID 4416 wrote to memory of 1316	4416	Setup_WinThruster_2022.exe	83
PID 4416 wrote to memory of 1316	4416	Setup_WinThruster_2022.exe	83

C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2022.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2022.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\is-DLN61.tmp\Setup_WinThruster_2022.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DLN61.tmp\Setup_WinThruster_2022.tmp" /SL5="$501E2,5556089,878080,C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2022.exe"
  2⤵
  - Executes dropped EXE
  PID:1316

C:\Users\Admin\AppData\Local\Temp\is-DLN61.tmp\Setup_WinThruster_2022.tmp

Filesize
3.1MB

MD5
e54d602e341148867b6314a9d0d497f6

SHA1
746b2a2380ff737505f2c3d4b8f28d7d6f9db7e0

SHA256
d683f80264ea32883ba13b2c641d595eaecb0f4efd77791d09713580cad304c6

SHA512
ad944b679fabd41954de8330f7eb9b644e374ee60d30cc89ed137578782446324b103a9937bac6aa9f0fbb65709e934e42e1d57cfa35b1f7c2de6885dacf798a

Download Submit
memory/4416-130-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4416-134-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4416-135-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download