76920592836662d1651d20afd9ac1afee41c96324e1cb7ddfde3698edc4dc628

Resubmissions

23-11-2022 11:54

23-11-2022 11:50

max time kernel
143s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:50

Target

DigioSmartClientWinV1.exe
Size

2.6MB
MD5

2c26a5fe35fb0d917f94abf706dc37ca
SHA1

3aacc94414991041c970ef8f09980e5966e9e18b
SHA256

76920592836662d1651d20afd9ac1afee41c96324e1cb7ddfde3698edc4dc628
SHA512

a6f39e56017beac8e7a1085e415e5e52d439d7a6ed6bdd59505e44bdcf39f253ceede3f4754bcf13c508d51247e04d8bcf2b6259c569bdeb98282c9d8c60a1b6
SSDEEP

49152:m75D5c14Z/7oFu9TNtROHcXUY2he3E/6BaMT8N2x9mV7dfR:K504Z/7x9XRO8F2c3GN2vYJ5

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

DigioSmartClientWinV1.tmp

pid process

620 DigioSmartClientWinV1.tmp
Loads dropped DLL 1 IoCs

Processes:

DigioSmartClientWinV1.exe

pid process

1636 DigioSmartClientWinV1.exe

pid	process
620	DigioSmartClientWinV1.tmp

pid	process
1636	DigioSmartClientWinV1.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

DigioSmartClientWinV1.exe

description	pid	process	target process
PID 1636 wrote to memory of 620	1636	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1636 wrote to memory of 620	1636	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1636 wrote to memory of 620	1636	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1636 wrote to memory of 620	1636	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1636 wrote to memory of 620	1636	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1636 wrote to memory of 620	1636	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1636 wrote to memory of 620	1636	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp

C:\Users\Admin\AppData\Local\Temp\is-VNNBN.tmp\DigioSmartClientWinV1.tmp
"C:\Users\Admin\AppData\Local\Temp\is-VNNBN.tmp\DigioSmartClientWinV1.tmp" /SL5="$70122,2498203,62976,C:\Users\Admin\AppData\Local\Temp\DigioSmartClientWinV1.exe"
2⤵
- Executes dropped EXE
PID:620

C:\Users\Admin\AppData\Local\Temp\is-VNNBN.tmp\DigioSmartClientWinV1.tmp
Filesize
702KB

MD5
3aa677774c26200eb78f1c5e23ee981c

SHA1
46688b35cc291c45b2eea674cc8cee4420652ecf

SHA256
8106da5409b257dd305a2de755abc653a48e158f7a8d6348a9a5ad36c5708e37

SHA512
b234f4dc2c85e47a9bc4616b1e53d20ce428c14e2487332d05c8cc4edc94486c79869a78c4761dc8c41ede8d9808b974c2da0a285f6a74a9ef581a460bfc7557

Download Submit
\Users\Admin\AppData\Local\Temp\is-VNNBN.tmp\DigioSmartClientWinV1.tmp
Filesize
702KB

MD5
3aa677774c26200eb78f1c5e23ee981c

SHA1
46688b35cc291c45b2eea674cc8cee4420652ecf

SHA256
8106da5409b257dd305a2de755abc653a48e158f7a8d6348a9a5ad36c5708e37

SHA512
b234f4dc2c85e47a9bc4616b1e53d20ce428c14e2487332d05c8cc4edc94486c79869a78c4761dc8c41ede8d9808b974c2da0a285f6a74a9ef581a460bfc7557

Download Submit
memory/620-59-0x0000000000000000-mapping.dmp

Download
memory/1636-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1636-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1636-57-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1636-62-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download