64a6b8d85dcbe4a5a30d8cb381778043179cadb3044e7d3d418a9aebb29b360b

Analysis

max time kernel
92s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-05-2023 17:08

Target

NTLite_setup_x64.exe
Size

23.5MB
MD5

391907fdc98797abccc1718767f736ef
SHA1

7471f0c2be722b6943f70cd1e16b8051d6bb195d
SHA256

64a6b8d85dcbe4a5a30d8cb381778043179cadb3044e7d3d418a9aebb29b360b
SHA512

76ecb4d249af88fba9753b278d1cb750603aa93c6c36e0ba02ab1b5680407d287c59a696f8b29f50732ebaa4a7f5b203f9ff72aa1c2ce0b4b9d0004c15848a90
SSDEEP

393216:pul8cgRtT0C6zhmTodWoDPJMr9a9zKNuHjRCLoyAzveL:pZcgRtIpzhmTaWozJr10Loywvg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2028	NTLite_setup_x64.tmp

Loads dropped DLL 1 IoCs

pid	Process
2040	NTLite_setup_x64.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2028	2040	NTLite_setup_x64.exe	28
PID 2040 wrote to memory of 2028	2040	NTLite_setup_x64.exe	28
PID 2040 wrote to memory of 2028	2040	NTLite_setup_x64.exe	28
PID 2040 wrote to memory of 2028	2040	NTLite_setup_x64.exe	28
PID 2040 wrote to memory of 2028	2040	NTLite_setup_x64.exe	28
PID 2040 wrote to memory of 2028	2040	NTLite_setup_x64.exe	28
PID 2040 wrote to memory of 2028	2040	NTLite_setup_x64.exe	28

C:\Users\Admin\AppData\Local\Temp\NTLite_setup_x64.exe
"C:\Users\Admin\AppData\Local\Temp\NTLite_setup_x64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\is-5QP5S.tmp\NTLite_setup_x64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5QP5S.tmp\NTLite_setup_x64.tmp" /SL5="$7012C,23634002,832512,C:\Users\Admin\AppData\Local\Temp\NTLite_setup_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:2028

C:\Users\Admin\AppData\Local\Temp\is-5QP5S.tmp\NTLite_setup_x64.tmp

Filesize
3.1MB

MD5
39b0f74f30db22b0c8969a0d990f9f9d

SHA1
1597fe464fcb835bfea66377a694dbab7573dbd3

SHA256
3a4c4954883d473bb90b10ae2a8ee5409dbcb39672440fdae12fd15c62153fc5

SHA512
da1b907b7ffeaf4b1732d86892a063f5e396dc301392a2f088cec1e7d9a20e6c3b4aa11cae195e3196eb2e1a1944b9e042a22c3cdd7f3571e0ba3af3c2a58ac6

Download Submit
\Users\Admin\AppData\Local\Temp\is-5QP5S.tmp\NTLite_setup_x64.tmp

Filesize
3.1MB

MD5
39b0f74f30db22b0c8969a0d990f9f9d

SHA1
1597fe464fcb835bfea66377a694dbab7573dbd3

SHA256
3a4c4954883d473bb90b10ae2a8ee5409dbcb39672440fdae12fd15c62153fc5

SHA512
da1b907b7ffeaf4b1732d86892a063f5e396dc301392a2f088cec1e7d9a20e6c3b4aa11cae195e3196eb2e1a1944b9e042a22c3cdd7f3571e0ba3af3c2a58ac6

Download Submit
memory/2028-62-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2028-64-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2040-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2040-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download