4ab764a919423949ab256b8bc68edbc953c7ee1f4153d880a2f3d4b76681028e

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2023, 03:19

Target

VSCodeUserSetup-x64-1.74.3.exe
Size

88.8MB
MD5

c4739833c15febf0151ba533b5aecee9
SHA1

154b082d7beef9402be9a8556e8d2f9cba08c544
SHA256

4ab764a919423949ab256b8bc68edbc953c7ee1f4153d880a2f3d4b76681028e
SHA512

1d70d625ea99b8f5809d733f9afa9072732265920d74f7a2d01b9e00b7e2c2e5765301f728b1ada93530b8f132a4d3d1f62655863ac1ae25c66ad2c131b3606d
SSDEEP

1572864:z4PrjCbcFnCeMzFOAXdzo9QODR2AGrwFBz2rkdOmsJZBOoE9fXM3gWFp+:8PryeMZOQJU26FBz2QdOmsqfXlWFp+

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2500	VSCodeUserSetup-x64-1.74.3.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2500	1684	VSCodeUserSetup-x64-1.74.3.exe	81
PID 1684 wrote to memory of 2500	1684	VSCodeUserSetup-x64-1.74.3.exe	81
PID 1684 wrote to memory of 2500	1684	VSCodeUserSetup-x64-1.74.3.exe	81

C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.74.3.exe
"C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.74.3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\is-0V36A.tmp\VSCodeUserSetup-x64-1.74.3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0V36A.tmp\VSCodeUserSetup-x64-1.74.3.tmp" /SL5="$B004C,92043323,828416,C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.74.3.exe"
  2⤵
  - Executes dropped EXE
  PID:2500

C:\Users\Admin\AppData\Local\Temp\is-0V36A.tmp\VSCodeUserSetup-x64-1.74.3.tmp

Filesize
2.5MB

MD5
78d348f50d4c5c9ac6fa862d132fb854

SHA1
3eae936e26d51f608b5c41002f949aca324c4a2e

SHA256
7ec482e67544f5e8d2440abdcc1addba4cc420f2d1f4e5392876c6197f41958b

SHA512
c6f1d70b8782eb032ff7d1cad5eb115aa2da5494913e8a34b25a2a85fce7093b60f3b15765a65c9060edba3dcedcf2e4f5c60b4c8bc223257ad03b22830d8c65

Download Submit
memory/1684-132-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1684-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1684-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download