5bd23c4dc64b65701d8b7948d87f33c757db01fbd94446eb3bab9e1aea735ce1

Analysis

max time kernel
29s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/04/2023, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cuphead/__support/scriptinterpreter.exe
Size

1.1MB
MD5

838f5a821203e6694f2d52f4b43a0fed
SHA1

64c01c33391c961f2a8f2c1dc52022b4524e1f61
SHA256

ee2af72e557435c833298115ab0b6a8ff85fc10488c67272151a890a2b1938ab
SHA512

18f4a9e693d17530734f784e5081beb929d63e5d1a4d336bd1c338435206ba1cef6d99cd27cd329e2bcd72f556387c737d420df541bc6d2f2669a9f41b282b1e
SSDEEP

24576:qBW9t1NCb5s07FKUUwloe2aEOh+2LGkS10t8Iy5YtPlqQFfYmFr:vdgNFDoeYOWO85Yttq9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1300	scriptinterpreter.tmp

Loads dropped DLL 2 IoCs

pid	Process
1324	scriptinterpreter.exe
1300	scriptinterpreter.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1300	1324	scriptinterpreter.exe	27
PID 1324 wrote to memory of 1300	1324	scriptinterpreter.exe	27
PID 1324 wrote to memory of 1300	1324	scriptinterpreter.exe	27
PID 1324 wrote to memory of 1300	1324	scriptinterpreter.exe	27
PID 1324 wrote to memory of 1300	1324	scriptinterpreter.exe	27
PID 1324 wrote to memory of 1300	1324	scriptinterpreter.exe	27
PID 1324 wrote to memory of 1300	1324	scriptinterpreter.exe	27

C:\Users\Admin\AppData\Local\Temp\Cuphead\__support\scriptinterpreter.exe
"C:\Users\Admin\AppData\Local\Temp\Cuphead\__support\scriptinterpreter.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\is-PG0LI.tmp\scriptinterpreter.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PG0LI.tmp\scriptinterpreter.tmp" /SL5="$70124,559450,185856,C:\Users\Admin\AppData\Local\Temp\Cuphead\__support\scriptinterpreter.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-PG0LI.tmp\scriptinterpreter.tmp

Filesize
1.2MB

MD5
81deecc63c5d711b1da2d3f70cfa517c

SHA1
af9cf82840d27bb0b8abbcb619c7a77619eeed6c

SHA256
336c9d33eb17c249295a0bdc8cd60d6e1bbe1c5e97d3e7f035ce775eba4aff2b

SHA512
a4ea8366394bf290d4cfbf6126aea85fecc85196948bacc79704bf184819436d92220a0517849040039397f555e27a2b6adb5512df99824073becbe45a3bd9b3

Download Submit
\Users\Admin\AppData\Local\Temp\is-EBCFJ.tmp\uninstall.dll

Filesize
689KB

MD5
b57815f1a4c9bd6cb7dc729fe90a7210

SHA1
04d1ebdb8f1c67ef2c2e17a2679754bddd133630

SHA256
8249f3c7cb935d0cd388df821cb9eb95bc6c7cb9908d8ab956fe65a1964ad2cd

SHA512
d9f896c9dccf776ce976adab48202f9bf9a7150c6a5e10475baae2b4d6fcdbc68d158c33762b3b51f44166126130089412785fbb2f8b3a37536ecc20d8ffa657

Download Submit
\Users\Admin\AppData\Local\Temp\is-PG0LI.tmp\scriptinterpreter.tmp

Filesize
1.2MB

MD5
81deecc63c5d711b1da2d3f70cfa517c

SHA1
af9cf82840d27bb0b8abbcb619c7a77619eeed6c

SHA256
336c9d33eb17c249295a0bdc8cd60d6e1bbe1c5e97d3e7f035ce775eba4aff2b

SHA512
a4ea8366394bf290d4cfbf6126aea85fecc85196948bacc79704bf184819436d92220a0517849040039397f555e27a2b6adb5512df99824073becbe45a3bd9b3

Download Submit
memory/1300-61-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1300-65-0x0000000002DB0000-0x0000000002E67000-memory.dmp

Filesize
732KB

Download
memory/1300-67-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/1300-69-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1300-70-0x0000000002DB0000-0x0000000002E67000-memory.dmp

Filesize
732KB

Download
memory/1300-74-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1324-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1324-68-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1324-76-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads