2e5f727b95527d3320a50400c48bec4208dd10f39776e667fccfc943287f27ff

Analysis

max time kernel
82s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:44

Target

setup_pstmafm44x_20220402_Beta.exe
Size

29.0MB
MD5

153d9212e049fa053d2337de207f169f
SHA1

8c8b0692d48c3bc8ede9f426993f283943c79537
SHA256

2e5f727b95527d3320a50400c48bec4208dd10f39776e667fccfc943287f27ff
SHA512

daa6a6e39824ded9cbc716ac2aa734c7be124fbfb1156ed03818b9d7891d7cbf7685c73f82cdf82f0812ae9f64d0f1da89523dc5060f589da04b06ef8230d6a0
SSDEEP

786432:iliap7IQWxhhh+3vLccvBG7yadtUlkiYno6RgzQCTyr0satP8:iliaBEhhh+3vNvBGyeGk5o6i0Ayr0sY0

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.tmp

pid process

4128 setup_pstmafm44x_20220402_Beta.tmp

pid	process
4128	setup_pstmafm44x_20220402_Beta.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.exe

description	pid	process	target process
PID 4188 wrote to memory of 4128	4188	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 4188 wrote to memory of 4128	4188	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 4188 wrote to memory of 4128	4188	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp

C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe
"C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4188

C:\Users\Admin\AppData\Local\Temp\is-OK95E.tmp\setup_pstmafm44x_20220402_Beta.tmp
"C:\Users\Admin\AppData\Local\Temp\is-OK95E.tmp\setup_pstmafm44x_20220402_Beta.tmp" /SL5="$B005E,29710762,721408,C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe"
2⤵
- Executes dropped EXE
PID:4128

C:\Users\Admin\AppData\Local\Temp\is-OK95E.tmp\setup_pstmafm44x_20220402_Beta.tmp
Filesize
2.4MB

MD5
8e2d270339dcd0a68fbb2f02a65d45dd

SHA1
bfcdb1f71692020858f96960e432e94a4e70c4a4

SHA256
506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

SHA512
31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

Download Submit
memory/4128-134-0x0000000000000000-mapping.dmp

Download
memory/4188-132-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4188-136-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4188-137-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download