3212aa98f6c8d67aa997a074578010b36d3df5d1a6d2055f5434ba8632fc260e

Analysis

max time kernel
143s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 21:38

Target

fdm_x64_setup.exe
Size

34.0MB
MD5

ca2ead342a22fcd891f73f99cba91005
SHA1

6e6470b49e9e9791acc6854b3d3823e97b058407
SHA256

3212aa98f6c8d67aa997a074578010b36d3df5d1a6d2055f5434ba8632fc260e
SHA512

39e8e285f3bc169ce3306cecf7a06317a93126dfce2d128acbb0a82d693d98ba0297601e258e4fa48ab8d2f235c6f8b5b648b48f15c02022e22893095a470bc6
SSDEEP

786432:5fzVFV7zFAsPBoyK32MlH8CSC9xSWEjh/dlCBS1Y/qemqa:/fWyKGMlcnelEdlO0YLa

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

fdm_x64_setup.tmp

pid process

4252 fdm_x64_setup.tmp

pid	process
4252	fdm_x64_setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fdm_x64_setup.exe

description	pid	process	target process
PID 4312 wrote to memory of 4252	4312	fdm_x64_setup.exe	fdm_x64_setup.tmp
PID 4312 wrote to memory of 4252	4312	fdm_x64_setup.exe	fdm_x64_setup.tmp
PID 4312 wrote to memory of 4252	4312	fdm_x64_setup.exe	fdm_x64_setup.tmp

C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4312

C:\Users\Admin\AppData\Local\Temp\is-LIR4E.tmp\fdm_x64_setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LIR4E.tmp\fdm_x64_setup.tmp" /SL5="$D0038,34943088,780288,C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"
2⤵
- Executes dropped EXE
PID:4252

C:\Users\Admin\AppData\Local\Temp\is-LIR4E.tmp\fdm_x64_setup.tmp

Filesize
2.5MB

MD5
869c50863faef0fa7052b5551698ed58

SHA1
feb12f73e0a68d43db51a35f04be3f9d2aac90a3

SHA256
7e49962115092d3709b9a3e68934972931bb900f23bf4b42ac90d250725e7d4e

SHA512
19076555396601758b0b62a9b9fc68bb96b83387c5a345c3e68f5794b67c45bec7905654fe1243e2daf3ae8fe11c2ad243e962633370535a7a3f41bcb7fec1df

Download Submit
memory/4252-138-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/4252-140-0x0000000000400000-0x0000000000682000-memory.dmp

Filesize
2.5MB

Download
memory/4312-133-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4312-139-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download