3276b743f66e1d4b84701959a96ccec4e543d6de39cda61c21d1a21bebf1f779

Analysis

max time kernel
56s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2022, 05:38

Target

Setup.exe
Size

457.1MB
MD5

aa035b5cc5302df7dd4daeef996eda50
SHA1

d2eb27fd73dd479d2a64930578229b7b4096a9f5
SHA256

543d20b501a808f51aaa083158c196f07de2f0ab56e34aebbe0858bdb65abcff
SHA512

0b94ad6536229417b31968b4201877c3d38005cf0478afeaeed0575d021e36fb7cff633152395daef0df1f2f81cffc2e77b19a3605526d96dc1c30c7cf307d65
SSDEEP

12288:fIipf19UlmFI5ojbOh4EV8QdxSvx3uE8L7y/npsASJBQCHj8Gqq3DEd/E/JycH7S:V9UgzjlOUXi2sDdjiBajNAlV0AN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 2708	3920	Setup.exe	80

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2708	3920	Setup.exe	80
PID 3920 wrote to memory of 2708	3920	Setup.exe	80
PID 3920 wrote to memory of 2708	3920	Setup.exe	80
PID 3920 wrote to memory of 2708	3920	Setup.exe	80
PID 3920 wrote to memory of 2708	3920	Setup.exe	80
PID 3920 wrote to memory of 2708	3920	Setup.exe	80
PID 3920 wrote to memory of 2708	3920	Setup.exe	80
PID 3920 wrote to memory of 2708	3920	Setup.exe	80
PID 3920 wrote to memory of 2708	3920	Setup.exe	80

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2708

memory/2708-134-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2708-138-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2708-139-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2708-140-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3920-132-0x0000026FE7F80000-0x0000026FE812A000-memory.dmp

Filesize
1.7MB

Download
memory/3920-133-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/3920-136-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download