8398bdba68d7520ed4743cd27839edbf7fb4591986ac6b485ca9308ba7400ab6

Analysis

max time kernel
189s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2023 21:33

Target

Nicky Romero - Kickstart 2.0 Setup.exe
Size

5.4MB
MD5

677852451fd2ac62bd984e36c5bd1ec7
SHA1

d44fda95330ba804d4a3530a267405be131c0942
SHA256

8398bdba68d7520ed4743cd27839edbf7fb4591986ac6b485ca9308ba7400ab6
SHA512

83e1bb7606319717e9c21efbde35f343d49b5ff8847351c87c84d6c0c43965e98960d45daf0cb01d50188c996b64f0f0bd0e7d22cd9cac1481f40f24d599423d
SSDEEP

98304:xESk+isd1z9zgeyP8L+GR+lRoj+Toy43pKZhrYvDRCZS0x5/ewYo8C4Esgv:XNisnGe39+rZS3pKAQZFrrR8zt6

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4052	Nicky Romero - Kickstart 2.0 Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4052	4416	Nicky Romero - Kickstart 2.0 Setup.exe	82
PID 4416 wrote to memory of 4052	4416	Nicky Romero - Kickstart 2.0 Setup.exe	82
PID 4416 wrote to memory of 4052	4416	Nicky Romero - Kickstart 2.0 Setup.exe	82

C:\Users\Admin\AppData\Local\Temp\Nicky Romero - Kickstart 2.0 Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Nicky Romero - Kickstart 2.0 Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\is-7A7RA.tmp\Nicky Romero - Kickstart 2.0 Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7A7RA.tmp\Nicky Romero - Kickstart 2.0 Setup.tmp" /SL5="$801E4,4910590,780800,C:\Users\Admin\AppData\Local\Temp\Nicky Romero - Kickstart 2.0 Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:4052

C:\Users\Admin\AppData\Local\Temp\is-7A7RA.tmp\Nicky Romero - Kickstart 2.0 Setup.tmp

Filesize
2.5MB

MD5
5de456a8e1849735565dded694f45910

SHA1
11fc4a63d478b64e077c0c62d2c67e428c5d2c0c

SHA256
be382cec639818b7511ec2ff17560257c18584734ee1d8e5978eb9945a71b7b8

SHA512
c0ef06c2965205d5b52f340f5a4a3ffe3690b4da4b2b24c8e5b7abe668027096a135e30398d28b19167f3706b709f4906d2101fdf09e7517e642c3e413e3896e

Download Submit
memory/4052-134-0x0000000000000000-mapping.dmp

Download
memory/4416-132-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4416-136-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download