951c96faf86b41a91c2a5e1eafe8b94e1bec28653d194e5320c4385a36cfae5a

Analysis

max time kernel
148s
max time network
39s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/04/2023, 11:34

Target

Setup.exe
Size

6.7MB
MD5

23d9a8cf15fe71598614e769e409c3df
SHA1

b5b397f733c4acf378cf707c60db9488b38ce5a8
SHA256

5a68fb28c84d3c0850006e6d6355075d99049adf5c939afba3c945bad7be673c
SHA512

1b48ade8a793d4cdcd93b343175c1cc822ed3298c8293393edc702033b15e9fe9385967ca7fda33279dfa2790c59c9dad3c2181ed31a3f1fedaca4fd6f06e64f
SSDEEP

98304:lc+kjotiAzy6lfxocFW2kTBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64TRRs:cjOpzhrt9kTVHJack+YlGlSRRs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1824	2040	Setup.exe	28
PID 2040 wrote to memory of 1824	2040	Setup.exe	28
PID 2040 wrote to memory of 1824	2040	Setup.exe	28
PID 2040 wrote to memory of 1824	2040	Setup.exe	28
PID 2040 wrote to memory of 1824	2040	Setup.exe	28
PID 2040 wrote to memory of 1824	2040	Setup.exe	28
PID 2040 wrote to memory of 1824	2040	Setup.exe	28

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe
  "C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\Setup.exe" org.develnext.jphp.ext.javafx.FXLauncher
  2⤵
  PID:1824

memory/1824-164-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1824-84-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1824-92-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1824-114-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1824-117-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1824-147-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1824-181-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1824-183-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1824-185-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1824-217-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1824-218-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1824-220-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/2040-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download