6e40d297dee4e638efe0d0812f230b3bfc9f3ed7743c2e729b692c7fb9ccc013

Analysis

max time kernel
223s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 11:54

Target
WMOSetup_4.1.4.116.exe
Size 2.5MB
Sample221101-n25gdsbfe2
SHA256 6e40d297dee4e638efe0d0812f230b3bfc9f3ed7743c2e729b692c7fb9ccc013
MD5 4b1de52031324af30f596c2500c2716b
SHA1 0d7af3836867a09bed40e59524646fd5b27929d7
SHA512 5d6d2c254214d96d2949cc7a5634e46ab983dc9d9fb43917189d35587dc6c166d1eea6186c01664a65a07db8cacf3cd4d1572f88d44c1d64824faaac6b09e1b0
SSDEEP 49152:7gBpfiwPGRL7Mg0fvztE/4xTSoArJ56fySMRE9k8niFIzyAYXijmq/mqnA:cBpfjSL7wfvztE/4xGoAd5FaWyyAYyi5
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2132	WMOSetup_4.1.4.116.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 2132	4812	WMOSetup_4.1.4.116.exe	80
PID 4812 wrote to memory of 2132	4812	WMOSetup_4.1.4.116.exe	80
PID 4812 wrote to memory of 2132	4812	WMOSetup_4.1.4.116.exe	80

C:\Users\Admin\AppData\Local\Temp\WMOSetup_4.1.4.116.exe
"C:\Users\Admin\AppData\Local\Temp\WMOSetup_4.1.4.116.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\is-21V8T.tmp\WMOSetup_4.1.4.116.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-21V8T.tmp\WMOSetup_4.1.4.116.tmp" /SL5="$1301D8,2178023,186880,C:\Users\Admin\AppData\Local\Temp\WMOSetup_4.1.4.116.exe"
  2⤵
  - Executes dropped EXE
  PID:2132

WMOSetup_4.1.4.116.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-21V8T.tmp\WMOSetup_4.1.4.116.tmp
Size 1.2MB
SHA256 2760fc3c0f187353b1e0d3c27fd18704ac745e8ed5c0bcd9de5b7069994934f3
MD5 9f04fa59cee0f7d5fe2192a392c71919
SHA1 0865e143858e5f2d5955740aa5d27ae6a00019ab
SHA512 76454b3f875024e9943e9cfa06f77170f2a2342e6af9532d8210409773bed21059a400a1564cc7a9135f5f90e81bc9fb4256f4b9edc7250d1a2c81de67680ed7
SSDEEP 24576:FtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5DTx9N:rqTytRFk6ek1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4812-132-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4812-136-0x0000000000400000-0x0000000000438000-memory.dmp

Download