c0a51a28be1167b6a3abb26aa256f1a3abf21a6ca9694f9e11133c897a9fe4c0

Analysis

max time kernel
2s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 07:05

Target

c0a51a28be1167b6a3abb26aa256f1a3abf21a6ca9694f9e11133c897a9fe4c0.exe
Size

780KB
MD5

2b1c913dc285f13f929164faff5967a3
SHA1

5e0c5c239bbd18eea2e1441d53a39ef5070d1075
SHA256

c0a51a28be1167b6a3abb26aa256f1a3abf21a6ca9694f9e11133c897a9fe4c0
SHA512

44077d682f197ddcd15041da67e1d0bb24b1ff403718f4a759c10494b918f3070c3cdea1c884da3fc866390f1bfe05450b16e7dbc464aab45f21aa200e1dea96
SSDEEP

24576:qhiDoNJQWSSoGxS8BLa1wH9ZmaeZU8o+Ymk1oq1:eiDPWSSpxS8B+1wdZuZu+k1

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1836	setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 1836	3832	c0a51a28be1167b6a3abb26aa256f1a3abf21a6ca9694f9e11133c897a9fe4c0.exe	24
PID 3832 wrote to memory of 1836	3832	c0a51a28be1167b6a3abb26aa256f1a3abf21a6ca9694f9e11133c897a9fe4c0.exe	24
PID 3832 wrote to memory of 1836	3832	c0a51a28be1167b6a3abb26aa256f1a3abf21a6ca9694f9e11133c897a9fe4c0.exe	24

C:\Users\Admin\AppData\Local\Temp\c0a51a28be1167b6a3abb26aa256f1a3abf21a6ca9694f9e11133c897a9fe4c0.exe
"C:\Users\Admin\AppData\Local\Temp\c0a51a28be1167b6a3abb26aa256f1a3abf21a6ca9694f9e11133c897a9fe4c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Local\Temp\67141ad8\setup.exe
  "C:\Users\Admin\AppData\Local\Temp/67141ad8/setup.exe" ProfileFileName=step0.ini
  2⤵
  - Executes dropped EXE
  PID:1836

C:\Users\Admin\AppData\Local\Temp\67141ad8\setup.exe

Filesize
17KB

MD5
48e71bcd9bfc75dea83f804e8180166a

SHA1
5da19d894306fbfdf6c73e8da50386f2b2c8acad

SHA256
94a292cec51e80e881eecaf22cd608b76ee69c666a00e63ac85f8c22c981765b

SHA512
b957b210ac3156750f65fb5aa7e56235ed86fb798bbe28af211595cf7eb74925bafafc1eb60a1e752bcf633aee30141a53d6ec32f12e16cbfa12df13ae1e28d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\67141ad8\setup.exe

Filesize
13KB

MD5
39f4573fe5639fe774e8ac51912db7ed

SHA1
5d5a3f5d0856a305c16d9541b6efbe566ef760b0

SHA256
0587035bae2e277e5853b4b5aa5197276a5a86fb18a9ad8496f024a25a00b686

SHA512
5b6b9f9ce72af49520d84df708455b0062048e2dd8757687f9aa3ed67f3cd8f92c4050c8ece160b8e6333d3fe8f8034750dbcee80d2e533c90a41d249251710d

Download Submit