1db104f62f6ee220aeedf36c03a36ab25036c30949760ffd6a109a045d5ca4e7

Analysis

max time kernel
116s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2023 12:44

Target

Setup.exe
Size

6.3MB
MD5

2eaf48c0835a05b81e918b882f161abc
SHA1

76394bbc329a3fcf4f390cd51e5b7b1d03b97bf0
SHA256

a559ec6a8b7951551b1e10943326a9a7c585181acf91cf4ef267b2bde9b8173c
SHA512

b482c58c4d4f2760729c62d52a29f12ff66ad0841e44abdfbb7414c586e5dce6fb8eddb868ac9c38f2fb94d29d8da927cff7220119ca60d4a4c8b6a77a8ee4d1
SSDEEP

49152:WeBNiVuyf8RRkoSuQsAjKmKEGyjIT6xyU45/ahrvcgEOpXzvCGpKJ0vnQFUbnekE:5cVqRpTV/ALxrRYuDLWBy3MLXNYO/mol

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4196 set thread context of 2176	4196	Setup.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
428	4196	WerFault.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4196	Setup.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2176	4196	Setup.exe	88
PID 4196 wrote to memory of 2176	4196	Setup.exe	88
PID 4196 wrote to memory of 2176	4196	Setup.exe	88
PID 4196 wrote to memory of 2176	4196	Setup.exe	88

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2176
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4196 -s 964
  2⤵
  - Program crash
  PID:428

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 4196 -ip 4196
1⤵
PID:4580

memory/2176-133-0x0000000000B80000-0x0000000000BA7000-memory.dmp

Filesize
156KB

Download
memory/2176-134-0x0000000000B80000-0x0000000000BA7000-memory.dmp

Filesize
156KB

Download
memory/2176-135-0x0000000000B80000-0x0000000000BA7000-memory.dmp

Filesize
156KB

Download
memory/2176-138-0x0000000000B80000-0x0000000000BA7000-memory.dmp

Filesize
156KB

Download
memory/4196-136-0x000001D1A6610000-0x000001D1A6635000-memory.dmp

Filesize
148KB

Download