f2f66d038be816b0fdcf0c4dcb3b1ae792f0d7b6fab17d1ac41c32776dff086e

Analysis

max time kernel
1534s
max time network
1593s
platform
windows10-2004_x64
resource
win10v2004-20221111-es
resource tags

arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15-02-2023 04:45

Target

AutoPlay/Docs/setup.exe
Size

711KB
MD5

a4318d6bde23314f8dc6c28688cf1396
SHA1

2b4ad23828c7b7affee4b3d287c4df781531f728
SHA256

21e3837855917e831e262ceee2dd7728bcb595e9a625f98056fa9782d00bf9dd
SHA512

3f98214c53fa4d8d73a60ded0dc481e5b420391b10d832c6302a487356c3fc52e69a6f7f125c485dcf8b5ef760c92949e22619551481628a05507a17c460aadd
SSDEEP

12288:iQiGXtG128pzy9AHCcsxiy/MZ4HzKDNvOvb+SYEhrVK57r9nSd5YjNPjalQZ:iQi6G12CziznhmRDVOvbTLrK5lAYTZ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4376	setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 4376	1600	setup.exe	80
PID 1600 wrote to memory of 4376	1600	setup.exe	80
PID 1600 wrote to memory of 4376	1600	setup.exe	80

C:\Users\Admin\AppData\Local\Temp\AutoPlay\Docs\setup.exe
"C:\Users\Admin\AppData\Local\Temp\AutoPlay\Docs\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\is-8RQR0.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8RQR0.tmp\setup.tmp" /SL5="$90054,131584,0,C:\Users\Admin\AppData\Local\Temp\AutoPlay\Docs\setup.exe"
  2⤵
  - Executes dropped EXE
  PID:4376

C:\Users\Admin\AppData\Local\Temp\is-8RQR0.tmp\setup.tmp

Filesize
763KB

MD5
4c194c4d71d4bd4e9b6a46a5062f94c5

SHA1
5c164db67fb3d3a7277567a66910a51eaeafc991

SHA256
0f5068b9615f40f119fdbf5f35c06c05f5907ba7500964ddf07ee3def9df8fa1

SHA512
83d4121005a64583bddb366bf5c494ecf0a3c882391432c9e28ffcaa95ed2131adf05c7749c578fa71852d82689f90a52a9ce44ce738e606b461239fd95cdaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8RQR0.tmp\setup.tmp

Filesize
763KB

MD5
4c194c4d71d4bd4e9b6a46a5062f94c5

SHA1
5c164db67fb3d3a7277567a66910a51eaeafc991

SHA256
0f5068b9615f40f119fdbf5f35c06c05f5907ba7500964ddf07ee3def9df8fa1

SHA512
83d4121005a64583bddb366bf5c494ecf0a3c882391432c9e28ffcaa95ed2131adf05c7749c578fa71852d82689f90a52a9ce44ce738e606b461239fd95cdaa5

Download Submit
memory/1600-132-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1600-137-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download