3212aa98f6c8d67aa997a074578010b36d3df5d1a6d2055f5434ba8632fc260e

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 21:55

Target

fdm_x64_setup.exe
Size

34.0MB
MD5

ca2ead342a22fcd891f73f99cba91005
SHA1

6e6470b49e9e9791acc6854b3d3823e97b058407
SHA256

3212aa98f6c8d67aa997a074578010b36d3df5d1a6d2055f5434ba8632fc260e
SHA512

39e8e285f3bc169ce3306cecf7a06317a93126dfce2d128acbb0a82d693d98ba0297601e258e4fa48ab8d2f235c6f8b5b648b48f15c02022e22893095a470bc6
SSDEEP

786432:5fzVFV7zFAsPBoyK32MlH8CSC9xSWEjh/dlCBS1Y/qemqa:/fWyKGMlcnelEdlO0YLa

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

fdm_x64_setup.tmp

pid process

3012 fdm_x64_setup.tmp

pid	process
3012	fdm_x64_setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fdm_x64_setup.exe

description	pid	process	target process
PID 1208 wrote to memory of 3012	1208	fdm_x64_setup.exe	fdm_x64_setup.tmp
PID 1208 wrote to memory of 3012	1208	fdm_x64_setup.exe	fdm_x64_setup.tmp
PID 1208 wrote to memory of 3012	1208	fdm_x64_setup.exe	fdm_x64_setup.tmp

C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Local\Temp\is-CECU0.tmp\fdm_x64_setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-CECU0.tmp\fdm_x64_setup.tmp" /SL5="$B01BE,34943088,780288,C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"
2⤵
- Executes dropped EXE
PID:3012

C:\Users\Admin\AppData\Local\Temp\is-CECU0.tmp\fdm_x64_setup.tmp

Filesize
2.5MB

MD5
869c50863faef0fa7052b5551698ed58

SHA1
feb12f73e0a68d43db51a35f04be3f9d2aac90a3

SHA256
7e49962115092d3709b9a3e68934972931bb900f23bf4b42ac90d250725e7d4e

SHA512
19076555396601758b0b62a9b9fc68bb96b83387c5a345c3e68f5794b67c45bec7905654fe1243e2daf3ae8fe11c2ad243e962633370535a7a3f41bcb7fec1df

Download Submit
memory/1208-132-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1208-134-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1208-137-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3012-135-0x0000000000000000-mapping.dmp

Download