e26e459631c3c6a9ee9c498bbcee99ec67e8534a52313e1b13c0ed9639d162cb

Analysis

max time kernel
1s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-03-2023 23:09

Target

start-survey-1.2-installer_x6As-l1.exe
Size

1.7MB
MD5

d0dafc349ed205185e9c30382209c1c6
SHA1

4494d56773274595b9422287d3786f8dc339a162
SHA256

e26e459631c3c6a9ee9c498bbcee99ec67e8534a52313e1b13c0ed9639d162cb
SHA512

94f00c998e05fca7ff668fb530e7c04fcb2427ef9c4a0ed9968b1e5543dc08c27ffb9675555a4297f2e7cd247713230340264533e40658f09e0e46d6d844d587
SSDEEP

24576:b7FUDowAyrTVE3U5FmpiIe9paPaJPfrT90eKc4cgFLNPfs8duMpmsDk:bBuZrEUVIDwPH9RHgFLRdp/o

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1496	start-survey-1.2-installer_x6As-l1.tmp

Loads dropped DLL 1 IoCs

pid	Process
1544	start-survey-1.2-installer_x6As-l1.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1496	1544	start-survey-1.2-installer_x6As-l1.exe	28
PID 1544 wrote to memory of 1496	1544	start-survey-1.2-installer_x6As-l1.exe	28
PID 1544 wrote to memory of 1496	1544	start-survey-1.2-installer_x6As-l1.exe	28
PID 1544 wrote to memory of 1496	1544	start-survey-1.2-installer_x6As-l1.exe	28
PID 1544 wrote to memory of 1496	1544	start-survey-1.2-installer_x6As-l1.exe	28
PID 1544 wrote to memory of 1496	1544	start-survey-1.2-installer_x6As-l1.exe	28
PID 1544 wrote to memory of 1496	1544	start-survey-1.2-installer_x6As-l1.exe	28

C:\Users\Admin\AppData\Local\Temp\start-survey-1.2-installer_x6As-l1.exe
"C:\Users\Admin\AppData\Local\Temp\start-survey-1.2-installer_x6As-l1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\is-5AQ9H.tmp\start-survey-1.2-installer_x6As-l1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5AQ9H.tmp\start-survey-1.2-installer_x6As-l1.tmp" /SL5="$70122,875199,832512,C:\Users\Admin\AppData\Local\Temp\start-survey-1.2-installer_x6As-l1.exe"
  2⤵
  - Executes dropped EXE
  PID:1496

C:\Users\Admin\AppData\Local\Temp\is-5AQ9H.tmp\start-survey-1.2-installer_x6As-l1.tmp

Filesize
3.0MB

MD5
66e28ba4a7871e5999d91e764aa052b8

SHA1
21a8eeaa8bef42f741dea23a7448c954ceab50d5

SHA256
3fa63dce69ae90db2d60388abc4f14285e8adec8c4e210b3f4d86c84b4186db5

SHA512
80808dc65f7fe740d618edca6368f937ba82687f362dff37521b51e4a70834d99f0fdbd4978ec0ee0056f3e34590293e2e36dd3305f1ed28b48c8a9c2f1376e8

Download Submit
\Users\Admin\AppData\Local\Temp\is-5AQ9H.tmp\start-survey-1.2-installer_x6As-l1.tmp

Filesize
3.0MB

MD5
66e28ba4a7871e5999d91e764aa052b8

SHA1
21a8eeaa8bef42f741dea23a7448c954ceab50d5

SHA256
3fa63dce69ae90db2d60388abc4f14285e8adec8c4e210b3f4d86c84b4186db5

SHA512
80808dc65f7fe740d618edca6368f937ba82687f362dff37521b51e4a70834d99f0fdbd4978ec0ee0056f3e34590293e2e36dd3305f1ed28b48c8a9c2f1376e8

Download Submit
memory/1496-61-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1544-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download