1d5dba3779c655b36f183737b4ca2a9022dc1bf01d39c01061c294dce6002574

Analysis

max time kernel
61s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2022, 04:39

Target

Instalador SisFarmacia V4.0/SisFarmacia.exe
Size

26.3MB
MD5

d70ef7837cfe5384462b2beefa416a29
SHA1

cd3a9add1593afdd2ed010d03293837275a0685f
SHA256

db5f11d627bc35e0ae02c83b3aa8bcde104f8b0002213aa4b2ebdfc22dc80b23
SHA512

9027c8dd06805b79f1e2dbf0ba83d87c3c01a642c4a92b2bf7f218814ac95b424a19855a20e146af8d2c2280f105edfd1235b27642e4ecdf20048c046a6a6a84
SSDEEP

786432:+RVsd+VFvQYHQY1pjPPNsNlEDJ0Z8+hcO2ona7c:YVFY+1pbNi+N2CSaQ

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1360	SisFarmacia.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1360	748	SisFarmacia.exe	80
PID 748 wrote to memory of 1360	748	SisFarmacia.exe	80
PID 748 wrote to memory of 1360	748	SisFarmacia.exe	80

C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\SisFarmacia.exe
"C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\SisFarmacia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\is-KUF83.tmp\SisFarmacia.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KUF83.tmp\SisFarmacia.tmp" /SL5="$801C4,26858922,797184,C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\SisFarmacia.exe"
  2⤵
  - Executes dropped EXE
  PID:1360

C:\Users\Admin\AppData\Local\Temp\is-KUF83.tmp\SisFarmacia.tmp

Filesize
2.5MB

MD5
27468e29378f0528abb039cd242b99a9

SHA1
b8c088508ff39708c1048b6fc64106339a8c5c52

SHA256
14e7028ed14eed990ef349ddcd991fe53c37416307b05e6cdc0c2eebeb8f6734

SHA512
1cc62d4c28cacc120c0bfd7ebc80432f6b17f2b0d4d9d51ebb2122e265138f42cd14ddc2992bb9c863cc2207f0c02abb7e2900aee5a4f08b971801078c3fb827

Download Submit
memory/748-132-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/748-134-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/748-137-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download