5bd9961365c198adccc1cd1bf89c9a86bcb4c4e02144878b443a87ba9324370c

Analysis

max time kernel
75s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2022 23:35

Target

TL_Installer_legacy.exe
Size

115.1MB
MD5

a1df83db3ac9856af4541c2c8641dce3
SHA1

5fea76b7954eedf2df81ea10d888fab62994813d
SHA256

5bd9961365c198adccc1cd1bf89c9a86bcb4c4e02144878b443a87ba9324370c
SHA512

d70b90ed7cf6349cd8e0534ba47f000461180245e6480217d8c149239a5962f3db726654f5c248250a0bbff86fbd2ae79889d393742acb0ce8af077956851e1c
SSDEEP

3145728:su0d/f07Lhq7sggz2l40chBXBRmu2QZ0F:s9Bs5xg02l40aRmu2QK

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4160	TL_Installer_legacy.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4160	1936	TL_Installer_legacy.exe	80
PID 1936 wrote to memory of 4160	1936	TL_Installer_legacy.exe	80
PID 1936 wrote to memory of 4160	1936	TL_Installer_legacy.exe	80

C:\Users\Admin\AppData\Local\Temp\TL_Installer_legacy.exe
"C:\Users\Admin\AppData\Local\Temp\TL_Installer_legacy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\is-A7UFK.tmp\TL_Installer_legacy.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A7UFK.tmp\TL_Installer_legacy.tmp" /SL5="$A0040,118826823,1202176,C:\Users\Admin\AppData\Local\Temp\TL_Installer_legacy.exe"
  2⤵
  - Executes dropped EXE
  PID:4160

C:\Users\Admin\AppData\Local\Temp\is-A7UFK.tmp\TL_Installer_legacy.tmp

Filesize
3.4MB

MD5
427cf7a7886e875bbd1e20f38c5dcae4

SHA1
d9268b95627c9fa3a32905010aee981ba3d43d76

SHA256
bf8baa082ef95bf9aa5337ce25207614c77265a521734642ec8491026b780ef6

SHA512
b20602fb81afcae942bfdd61dbada78fcea435d1d995309ed317ba5873fe993b346cc02c44c6a8fa9dd93c825a85154ce73b3f49a71f164734b5a6fe5b1ec1b6

Download Submit
memory/1936-132-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/1936-135-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/1936-137-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download