6f47c3f41fcd0dde186bef174574b8473bae81cd050d88f2953e5814c0f12a12

Analysis

max time kernel
60s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:08

Target

rob_setup.exe
Size

3.8MB
MD5

15d7d8d30cff7298b426aee77c8921d1
SHA1

f3139a950ae1e030d77af3ae037ea2107aa5f58f
SHA256

6f47c3f41fcd0dde186bef174574b8473bae81cd050d88f2953e5814c0f12a12
SHA512

f74d01ef35dc0f703d43e0fbac1deb1a42ce0825de81c69919a6f7107592a94c96bb0d7a62809afc60f7c19b2dd818c4f2909a66d508a18de030e235ac148358
SSDEEP

98304:gEtaHbvRayraF3q3YALB3Br4IWBS3xi1Yo8C4Esg3:6LhI63Bcqhi1R8ztU

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

rob_setup.tmp

pid process

4288 rob_setup.tmp

pid	process
4288	rob_setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rob_setup.exe

description	pid	process	target process
PID 3540 wrote to memory of 4288	3540	rob_setup.exe	rob_setup.tmp
PID 3540 wrote to memory of 4288	3540	rob_setup.exe	rob_setup.tmp
PID 3540 wrote to memory of 4288	3540	rob_setup.exe	rob_setup.tmp

C:\Users\Admin\AppData\Local\Temp\rob_setup.exe
"C:\Users\Admin\AppData\Local\Temp\rob_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3540

C:\Users\Admin\AppData\Local\Temp\is-N8LFL.tmp\rob_setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-N8LFL.tmp\rob_setup.tmp" /SL5="$D01EE,2575279,780800,C:\Users\Admin\AppData\Local\Temp\rob_setup.exe"
2⤵
- Executes dropped EXE
PID:4288

C:\Users\Admin\AppData\Local\Temp\is-N8LFL.tmp\rob_setup.tmp
Filesize
2.5MB

MD5
5fd78f8456484021806be6944cca3bd8

SHA1
ca205a25192195c72762b5af4379d96b71cfb004

SHA256
41516d754bcc18ef5659d9c69abba163a637d52f25e4ddc69548283826a95e96

SHA512
24328c63cecf0fa1fc121e3ec2cc696161b4cb04862de88f4554181707f1c92cfa56854021c4583abd9e26fc1848f0ae9c0222add77bd55ed9bcd884dc8d71d1

Download Submit
memory/3540-132-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3540-136-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4288-134-0x0000000000000000-mapping.dmp

Download