565be6b129c1976ad1d57d8e5304e11b91f7b045a32fc877437b935b86f0aa80

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2023, 23:47

Target

Setup.exe
Size

2.7MB
MD5

c65cf922a22f331d5762c8c810ec2a77
SHA1

f5a403decdf3819eba22900cf76f812e36f2521b
SHA256

565be6b129c1976ad1d57d8e5304e11b91f7b045a32fc877437b935b86f0aa80
SHA512

15b5b56090280fc0c1ce1b0436a73bf5605f18da08197302d09a25ea01265bdc1aa9e4e231c950eaa0ca066b34b8a3b3f8c9343e479ee491a2062b018cbb6018
SSDEEP

49152:RBuZrEUKDEWFINqGFMVFHwXGuP1eklXTX:3kLK7ac5V6XGujljX

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1532	Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1532	1636	Setup.exe	85
PID 1636 wrote to memory of 1532	1636	Setup.exe	85
PID 1636 wrote to memory of 1532	1636	Setup.exe	85

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\is-GP11M.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GP11M.tmp\Setup.tmp" /SL5="$B0048,881152,0,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1532

C:\Users\Admin\AppData\Local\Temp\is-GP11M.tmp\Setup.tmp

Filesize
3.1MB

MD5
6be97c3e948113b96eec486a41ea7df2

SHA1
ffbe580deb19fee55f7329a7db6619fa52f974d3

SHA256
a561b065bf1f2b36a37698cf2e21edcf913c565c6ba618070a504bdb64b296d9

SHA512
a117895c1ee7b6cf52225ee07bf148d7fa039a1545748d31199db32b2302e78f8672446bc58390bb0705a0c3d1d7b6e8dc88194937feb43ccbda6330e69e5faa

Download Submit
memory/1532-138-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1532-141-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/1532-142-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1636-133-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1636-140-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download