2a808cfb9416c8c79a845a0831f58d06cda0d3d7d05cfa83cce7c6d1788cf6f6

Analysis

max time kernel
106s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2023, 23:29

Target

Days Gone update 1.06.exe
Size

16.3MB
MD5

ddaafb7060f04226585f1e657625424d
SHA1

b0ac851fca1e66e928734e76a3b29fdda2aba0c3
SHA256

0cb0ae806419886991db612c741e42e46c3b5e22226cf23a644c69fdda7e3eb2
SHA512

26adfcefbac8ee7cfc99dfe6ba8c0f631a0db91bd7216a22bd7351ec7105851a8b21a2851b2f6650c8a1835ae7340c8e66560df767b47235e823f5fdc418d62d
SSDEEP

393216:Ub+incCUGfINq3+SIpkcsndQUMLGQXdQ4SfFeUP2eqrZfBrN8vS:UXncCle7SS6+UMXdWFeUulvN6S

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4300	Days Gone update 1.06.tmp

Loads dropped DLL 1 IoCs

pid	Process
4300	Days Gone update 1.06.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4300	Days Gone update 1.06.tmp
4300	Days Gone update 1.06.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4300	Days Gone update 1.06.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4300	4708	Days Gone update 1.06.exe	82
PID 4708 wrote to memory of 4300	4708	Days Gone update 1.06.exe	82
PID 4708 wrote to memory of 4300	4708	Days Gone update 1.06.exe	82

C:\Users\Admin\AppData\Local\Temp\Days Gone update 1.06.exe
"C:\Users\Admin\AppData\Local\Temp\Days Gone update 1.06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Local\Temp\is-ADMDC.tmp\Days Gone update 1.06.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ADMDC.tmp\Days Gone update 1.06.tmp" /SL5="$60090,16262236,417280,C:\Users\Admin\AppData\Local\Temp\Days Gone update 1.06.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4300

C:\Users\Admin\AppData\Local\Temp\is-21T8A.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ADMDC.tmp\Days Gone update 1.06.tmp

Filesize
1.4MB

MD5
7020f586380e546141d85ccfa6baa625

SHA1
1dfaa37fbd265222376f3635d1feafc1e7c45d62

SHA256
3751a5035433dea375ee3696d13bf9a43ac1b354e20cf07a70262e975cf77afc

SHA512
02db8483748253879cadc0e0494b32cb98bc162ba77396d830e468da1426f6db8cb041dea66966294b02424b67ce813e77261d0a3689443bf0d5455267717940

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ADMDC.tmp\Days Gone update 1.06.tmp

Filesize
1.4MB

MD5
7020f586380e546141d85ccfa6baa625

SHA1
1dfaa37fbd265222376f3635d1feafc1e7c45d62

SHA256
3751a5035433dea375ee3696d13bf9a43ac1b354e20cf07a70262e975cf77afc

SHA512
02db8483748253879cadc0e0494b32cb98bc162ba77396d830e468da1426f6db8cb041dea66966294b02424b67ce813e77261d0a3689443bf0d5455267717940

Download Submit
memory/4708-132-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4708-137-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4708-139-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download