3f4ab40f84b5044f436b076024787a62f5444ab3549f49f8460ca6a72f949d00

Resubmissions

13-01-2023 12:35

10-01-2023 12:21

max time kernel
109s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2023 12:21

Target

Setup.exe
Size

450.0MB
MD5

cb2b683c08069259a1ad4eaa829cfeb4
SHA1

acae6f70cf1e360bb3656e936c45ca14d448f8c1
SHA256

0f08546b9b68ffd107a9bfb61985f1f07b7418e8a78b73eec441f8bbf2396de7
SHA512

7741c2e7ed7b62e930be73f1a49a17019ecd36a84bde628b50dd055d6e2940938f089f8c272a4a578af1db569b7ff702744d87762ea5fac1cbc019320b062e03
SSDEEP

24576:+S02yH58BY5FHoJhxIeeE98PKmyChWjzbyqo53xre6:o5t51pWkSyqo5Y

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 944 set thread context of 5096 944 Setup.exe InstallUtil.exe

description	pid	process	target process
PID 944 set thread context of 5096	944	Setup.exe	InstallUtil.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 944 wrote to memory of 5096	944	Setup.exe	InstallUtil.exe
PID 944 wrote to memory of 5096	944	Setup.exe	InstallUtil.exe
PID 944 wrote to memory of 5096	944	Setup.exe	InstallUtil.exe
PID 944 wrote to memory of 5096	944	Setup.exe	InstallUtil.exe
PID 944 wrote to memory of 5096	944	Setup.exe	InstallUtil.exe
PID 944 wrote to memory of 5096	944	Setup.exe	InstallUtil.exe
PID 944 wrote to memory of 5096	944	Setup.exe	InstallUtil.exe
PID 944 wrote to memory of 5096	944	Setup.exe	InstallUtil.exe
PID 944 wrote to memory of 5096	944	Setup.exe	InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:5096

memory/944-132-0x000002BDF92D0000-0x000002BDF946E000-memory.dmp

Filesize
1.6MB

Download
memory/944-133-0x00007FFF53890000-0x00007FFF54351000-memory.dmp

Filesize
10.8MB

Download
memory/944-136-0x00007FFF53890000-0x00007FFF54351000-memory.dmp

Filesize
10.8MB

Download
memory/5096-134-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5096-135-0x00000000004088ED-mapping.dmp

Download
memory/5096-138-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5096-139-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download