0b1d05f9ac7bd87f3828d46d467f5e0c8d70bdd7a62cece017bfe25819ed03bf

Analysis

max time kernel
186s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:21

Target

entry_1_0/revosetup (1).exe
Size

7.2MB
MD5

f8468a02b9542db2f833917fd9bfcc3f
SHA1

93dc5a487d17e7fc2aead5823806cee0f8b4ec15
SHA256

00ca2f850fbf5b70a801cc88e80ea3df8628981caa99dfd54775f0c0bd17682d
SHA512

c6b6f8cded2d59b47b35249318f7c2613a13a61774d390f7a19234d1ff903d5e0a5b252baa7c966e3e06519851387e78d9f36118aa1bb6bf7ec4ee38ac36c04e
SSDEEP

196608:iDC3zciZ7PNZDr4QnUOp+4PIfTqJqHjQ0F0M:vHPHDrhnUOEqSjQ/M

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1660	revosetup (1).tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1660	560	revosetup (1).exe	84
PID 560 wrote to memory of 1660	560	revosetup (1).exe	84
PID 560 wrote to memory of 1660	560	revosetup (1).exe	84

C:\Users\Admin\AppData\Local\Temp\entry_1_0\revosetup (1).exe
"C:\Users\Admin\AppData\Local\Temp\entry_1_0\revosetup (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\AppData\Local\Temp\is-D19BV.tmp\revosetup (1).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D19BV.tmp\revosetup (1).tmp" /SL5="$B01C6,6916522,266240,C:\Users\Admin\AppData\Local\Temp\entry_1_0\revosetup (1).exe"
  2⤵
  - Executes dropped EXE
  PID:1660

C:\Users\Admin\AppData\Local\Temp\is-D19BV.tmp\revosetup (1).tmp

Filesize
1.3MB

MD5
ccd36551de8189eb2847e54eabd8f871

SHA1
a77a1f09fcc3eefbc9b13ed98bf0dbb103efe940

SHA256
1e55c77218cb2363762407db483a47ff09614c9c8e9e0dd735067e1de321ebaf

SHA512
010a3f5ac281367baa5c946808408f91d840b18a0ce66f50e69ba0e758ec42852e880a9072ea10e4114956fa93eb9334dc1a2bbb6eaa5481c401871e98e2d535

Download Submit
memory/560-132-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/560-134-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/560-137-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download