d7eacf1c47c55f4432ed0fd6b394dc848e890e2cafae5961ffd6674ea2323155

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2023, 01:52

Target

FabFilter Total Bundle v2021.5 CE.exe
Size

42.5MB
MD5

ef891161cc08294e0d2711d497583edb
SHA1

0018e9b7d211a4818d84c7518fcffc280e3c3a70
SHA256

3dd98655077d905381808de4376cc3bc1d852f177035018f26145d81714338b6
SHA512

9ddbcf3bc3330f017d6e9d7a04a8171b9c6974004a7bb7c828df221fcd09fddc7a6d8b666fd74e980a521188f741252f55a8e0a226303567a2481ca9da6eb2dd
SSDEEP

786432:2PN6cMyndbnktgCp6HvT373C5ezAmRTO6bSxKN/ORaWHSfYVkYKFEdZa:mNMp673732krTO6OxKMRacSYVkYKFgs

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5116	FabFilter Total Bundle v2021.5 CE.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 5116	1372	FabFilter Total Bundle v2021.5 CE.exe	84
PID 1372 wrote to memory of 5116	1372	FabFilter Total Bundle v2021.5 CE.exe	84
PID 1372 wrote to memory of 5116	1372	FabFilter Total Bundle v2021.5 CE.exe	84

C:\Users\Admin\AppData\Local\Temp\FabFilter Total Bundle v2021.5 CE.exe
"C:\Users\Admin\AppData\Local\Temp\FabFilter Total Bundle v2021.5 CE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\is-F15V5.tmp\FabFilter Total Bundle v2021.5 CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-F15V5.tmp\FabFilter Total Bundle v2021.5 CE.tmp" /SL5="$D01BA,43513358,966144,C:\Users\Admin\AppData\Local\Temp\FabFilter Total Bundle v2021.5 CE.exe"
  2⤵
  - Executes dropped EXE
  PID:5116

C:\Users\Admin\AppData\Local\Temp\is-F15V5.tmp\FabFilter Total Bundle v2021.5 CE.tmp

Filesize
3.1MB

MD5
a01635de72c4d527db7c4d670f8b62ba

SHA1
a1054f6593951b6e22afaa0669cbc282383f028e

SHA256
1e98b6988fe224b4ce41432400e68a1fe429b4f7e459b3d524ace7a1364f442e

SHA512
3c62e0d86edffcf4d47656a9e03f00bb94db60d8aa47a4a2cce44e8b6b90a13cfc2eb9950f2b869ea6d416d2a1422bc12a1eb1bb2710449c9b734edb38718f3d

Download Submit
memory/1372-133-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1372-140-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/5116-139-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/5116-141-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/5116-142-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download