5ed560a642d19192beb2906c38947b076a46719e2b52cf655f3aac83106db226

Analysis

max time kernel
6s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-02-2023 12:00

Target

TL_Installer_legacy.exe
Size

115.1MB
MD5

b8c78abd54561235d4180d82087b7902
SHA1

8a53d5c6409490d6c679e9ea6ae87a846a9bdb3b
SHA256

5ed560a642d19192beb2906c38947b076a46719e2b52cf655f3aac83106db226
SHA512

ca524531c03e2dcf855177bc2242ae0380ec52c1f41991772537fde54ec236e7d3c96891a7128bdeaa34a443457cd46ddd8bcddf01edeb9a362fb2fb34be829f
SSDEEP

3145728:bu0d/f07Lhq7sggz2l40chBXBRmu2QZ0h:b9Bs5xg02l40aRmu2Q8

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
552	TL_Installer_legacy.tmp

Loads dropped DLL 1 IoCs

pid	Process
2012	TL_Installer_legacy.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 552	2012	TL_Installer_legacy.exe	27
PID 2012 wrote to memory of 552	2012	TL_Installer_legacy.exe	27
PID 2012 wrote to memory of 552	2012	TL_Installer_legacy.exe	27
PID 2012 wrote to memory of 552	2012	TL_Installer_legacy.exe	27
PID 2012 wrote to memory of 552	2012	TL_Installer_legacy.exe	27
PID 2012 wrote to memory of 552	2012	TL_Installer_legacy.exe	27
PID 2012 wrote to memory of 552	2012	TL_Installer_legacy.exe	27

C:\Users\Admin\AppData\Local\Temp\TL_Installer_legacy.exe
"C:\Users\Admin\AppData\Local\Temp\TL_Installer_legacy.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\is-9E901.tmp\TL_Installer_legacy.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9E901.tmp\TL_Installer_legacy.tmp" /SL5="$70120,118826823,1202176,C:\Users\Admin\AppData\Local\Temp\TL_Installer_legacy.exe"
  2⤵
  - Executes dropped EXE
  PID:552

C:\Users\Admin\AppData\Local\Temp\is-9E901.tmp\TL_Installer_legacy.tmp

Filesize
1.4MB

MD5
66bd599bc492f9ec2f32af606fc25357

SHA1
8661a6afb4418ce75023272d6f99ee42e03d81d4

SHA256
f69df11be74ff23b97b946238eddb87d67ae341ecc03b382408121ac6e53b382

SHA512
7e19a676634c1d34a36d704717bbeb6d5ea1390389e53b5c6ff6898ba7b61cc5a0018ffc4cb9d5989b931569f6f73d10dc42bfa5751f8de2a3d3e4a536a5af83

Download Submit
\Users\Admin\AppData\Local\Temp\is-9E901.tmp\TL_Installer_legacy.tmp

Filesize
3.1MB

MD5
c588f5742bb5806133e3e92309deffcd

SHA1
020f3d30e868fc12c9345ee7456a4add9620331d

SHA256
d220998a3f1bf5fe06544eba4df52a6ef68283acb2b5d18ef86cd6bdd68ce419

SHA512
b5fbfb9df101cc474ea14ee625189e817ce545b949751c6e074388f191514d79d564d94a341bc5e0a3a54a95bc0a7f5a675e72e3cc5b8cf73c0f2b53447177b2

Download Submit
memory/2012-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download