4c8873e5aca794dab631421e23b719de4ff7bd5df8af8b70e8e0dc95fbb35580

Analysis

max time kernel
151s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 13:14

Target

CloudConnectorSetup_3.0.12_Staging.exe
Size

19.9MB
MD5

4fdcf280024433e0f3c592d02ae6e4ee
SHA1

ef4f533dd34a8709dc714fc3cf19413ae44c28fe
SHA256

4c8873e5aca794dab631421e23b719de4ff7bd5df8af8b70e8e0dc95fbb35580
SHA512

7daa53a84cf25de51d1a9f240a8942a0ff3a08c441228aea77ea54ee257d0db4a69902fef3e3e0a079ec25061804a3ecd0de28971880f7a4d7d7b477a32b7eac
SSDEEP

393216:S0mX3vLeu0HEe/YDcOsSmLTUXIcIGQ/TG043Q/G0jxZVHkX6BK:dav0HENcNSsTCTI9/TGsbDVEXGK

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4084	CloudConnectorSetup_3.0.12_Staging.tmp

Loads dropped DLL 1 IoCs

pid	Process
4084	CloudConnectorSetup_3.0.12_Staging.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4084	5068	CloudConnectorSetup_3.0.12_Staging.exe	85
PID 5068 wrote to memory of 4084	5068	CloudConnectorSetup_3.0.12_Staging.exe	85
PID 5068 wrote to memory of 4084	5068	CloudConnectorSetup_3.0.12_Staging.exe	85

C:\Users\Admin\AppData\Local\Temp\CloudConnectorSetup_3.0.12_Staging.exe
"C:\Users\Admin\AppData\Local\Temp\CloudConnectorSetup_3.0.12_Staging.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\is-T1AD5.tmp\CloudConnectorSetup_3.0.12_Staging.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-T1AD5.tmp\CloudConnectorSetup_3.0.12_Staging.tmp" /SL5="$B004E,20058754,814080,C:\Users\Admin\AppData\Local\Temp\CloudConnectorSetup_3.0.12_Staging.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4084

C:\Users\Admin\AppData\Local\Temp\is-545V0.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-T1AD5.tmp\CloudConnectorSetup_3.0.12_Staging.tmp

Filesize
2.9MB

MD5
a8f16f3918088a566a126b4efcb55f44

SHA1
c94c641544c6aad5d8070dd5dab111e0eab17f3d

SHA256
3744484e4521de76ca5960c2e0dd7ec294a824a34ca244ef90beb4f6b3285ab6

SHA512
a0228abad70e181328b0ec4ae03c9e4b7f5f7860c2808bf1a539976aa053a332d943b5ad3d7b53a2b415fa5034f9fd9306b311f38b472fe495051e94af8a6cae

Download Submit
memory/4084-138-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/4084-145-0x0000000000400000-0x00000000006F6000-memory.dmp

Filesize
3.0MB

Download
memory/4084-146-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/5068-133-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/5068-144-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download