09ef4b9244eb44567917f2c42d946f0f0feec3eb2fab4a82a9cfb7a4880a88c3

Analysis

max time kernel
142s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 15:24

Target

Typograph_Setup.exe
Size

1.8MB
MD5

d83d5fddde82eab9f6b4268ebffba4cf
SHA1

e2c3d95e9e6c906e8dd532cc7ad77346da901d35
SHA256

09ef4b9244eb44567917f2c42d946f0f0feec3eb2fab4a82a9cfb7a4880a88c3
SHA512

d0a68b7aa0f56f792f5a2ac0a0ca8708c351acf85db061314a9c4ec23db86a8b8664b4d219416f8d34d9851f241d32830656aa90fba325999f68c2f901876f02
SSDEEP

49152:esg5bbIeH/0Ze8aXgGmdxvl8QgPI1dIzA7SYu:es4KvX5ddlBlrSYu

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

setup.exe

pid process

4980 setup.exe

pid	process
4980	setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Typograph_Setup.exe

description	pid	process	target process
PID 2224 wrote to memory of 4980	2224	Typograph_Setup.exe	setup.exe
PID 2224 wrote to memory of 4980	2224	Typograph_Setup.exe	setup.exe
PID 2224 wrote to memory of 4980	2224	Typograph_Setup.exe	setup.exe

C:\Users\Admin\AppData\Local\Temp\Typograph_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Typograph_Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe
".\setup.exe"
2⤵
- Executes dropped EXE
PID:4980

C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe
Filesize
117KB

MD5
7a2ba2348ec30410c3cac084b6c6210a

SHA1
a125cee521241b10f8c43cc66fe054ccf104307b

SHA256
130a7b764e0f49b3ce4a45b2b8a2c795574ae9c66548c341b0ad734ec9a8779c

SHA512
5b84c8c2f0eddfd9a7b7a39f94cc14b124752837be4d8701863d8562a27e01324d007a6e7b327b58a4288e0e5796fa1094c863eb95932e36ca4a4270bbaa93d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe
Filesize
117KB

MD5
7a2ba2348ec30410c3cac084b6c6210a

SHA1
a125cee521241b10f8c43cc66fe054ccf104307b

SHA256
130a7b764e0f49b3ce4a45b2b8a2c795574ae9c66548c341b0ad734ec9a8779c

SHA512
5b84c8c2f0eddfd9a7b7a39f94cc14b124752837be4d8701863d8562a27e01324d007a6e7b327b58a4288e0e5796fa1094c863eb95932e36ca4a4270bbaa93d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\typograf.exe
Filesize
926KB

MD5
6ba093cd82eadbb150e8edfb68dbbd66

SHA1
94b1b5e79a8fa034b71374d259e8a6fe507211a1

SHA256
d2b2831fdabda5384e777659e750ceb6ed7e6e145137873d482f0703f33e62a1

SHA512
61784b56367a59099ce429c7cfd67f5f00bb642e4c0e30e69f829c110ad74786a7077b35bef934fc50ac4c195d83c861a0fc335731cf8474400dce498e75e226

Download Submit
memory/4980-148-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download