27778cca3d3121f8a6d6eb18f184fec5a6180ea37f2019df5e7463dfec0d81f4

Analysis

max time kernel
189s
max time network
238s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2023 21:11

Target

SMP setup.exe
Size

196.6MB
MD5

927c1c98e8851a3d651cd0567490ff7a
SHA1

0d387869f07337eb3c8897834a3b89c2973165ae
SHA256

27778cca3d3121f8a6d6eb18f184fec5a6180ea37f2019df5e7463dfec0d81f4
SHA512

504585b11345765a0a6838f7de5078084efeba383b4d38556e714048451d91e35f2096c1c61030b31483a30afed88bd20fe85287866d5bfd5d5f71d398c47147
SSDEEP

3145728:2zNGszbqBKca0uR2UbLi2nDKafsCF953TnP6EU1U7j8w0oLxpAwWFLpjqDKCUDk:BTa1R2KiEzd953TP6Um4DAweqWZA

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4396	SMP setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4396	540	SMP setup.exe	81
PID 540 wrote to memory of 4396	540	SMP setup.exe	81
PID 540 wrote to memory of 4396	540	SMP setup.exe	81

C:\Users\Admin\AppData\Local\Temp\SMP setup.exe
"C:\Users\Admin\AppData\Local\Temp\SMP setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\is-Q3JRE.tmp\SMP setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q3JRE.tmp\SMP setup.tmp" /SL5="$7004A,205596299,209920,C:\Users\Admin\AppData\Local\Temp\SMP setup.exe"
  2⤵
  - Executes dropped EXE
  PID:4396

C:\Users\Admin\AppData\Local\Temp\is-Q3JRE.tmp\SMP setup.tmp

Filesize
1.5MB

MD5
f1137b2a2cd2bd596117090d9f2da793

SHA1
f16c89642990d661c24eb7f5db3a410596ea72c9

SHA256
361352552d47e35f2aa17f0d866d75135810a49cd8170f0b4050cf283f95a39f

SHA512
dd942a0df586c0ef64e8a45669165906566028c31e987ca1946bb9b5f8283e049b2ce2a55dff018529a3290dd8067784399422bf0dcfb7418d18251f2177d087

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q3JRE.tmp\SMP setup.tmp

Filesize
1.5MB

MD5
f1137b2a2cd2bd596117090d9f2da793

SHA1
f16c89642990d661c24eb7f5db3a410596ea72c9

SHA256
361352552d47e35f2aa17f0d866d75135810a49cd8170f0b4050cf283f95a39f

SHA512
dd942a0df586c0ef64e8a45669165906566028c31e987ca1946bb9b5f8283e049b2ce2a55dff018529a3290dd8067784399422bf0dcfb7418d18251f2177d087

Download Submit
memory/540-132-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/540-137-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/540-138-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download