e956e7c2dac35f397e788632594a465ea055140bade1b7fc80e0d205962f4e21

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2023, 15:42

Target

winMerge-setup.exe
Size

7.9MB
MD5

7de68a3c679a3c7377d3674c29ca76a0
SHA1

212d17cf8135a82f6e1f5529665f9cf5e50c8158
SHA256

e956e7c2dac35f397e788632594a465ea055140bade1b7fc80e0d205962f4e21
SHA512

f6ab749f29c88eaef7a55112203fbe5bfa8784870bae04e84abbf75c40667623711af816dec1b6c41ea9b579d39ece726d057b736b12e0b6da9ee97eb7d67f38
SSDEEP

196608:eFopfRL4Cxqy2mZnF5VgOKW0AEjNfJbJEHPwQakGNdHe4NZe:3p9T/nF5VgOKW0H7bJEPQpHTC

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
1180	winMerge-setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1180	1440	winMerge-setup.exe	84
PID 1440 wrote to memory of 1180	1440	winMerge-setup.exe	84
PID 1440 wrote to memory of 1180	1440	winMerge-setup.exe	84

C:\Users\Admin\AppData\Local\Temp\winMerge-setup.exe
"C:\Users\Admin\AppData\Local\Temp\winMerge-setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\is-H30J2.tmp\winMerge-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-H30J2.tmp\winMerge-setup.tmp" /SL5="$90118,7659121,121344,C:\Users\Admin\AppData\Local\Temp\winMerge-setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1180

C:\Users\Admin\AppData\Local\Temp\is-H30J2.tmp\winMerge-setup.tmp

Filesize
1.1MB

MD5
7be6afa2406002952e1a2d405f8e068b

SHA1
3e261244079d46adf369c984107fe22135d788be

SHA256
3bdf5f9a7a14c6972e168adbb7eeee1e471fdcb30df873c08a931032c5716ca4

SHA512
6673365902d74be7262eb23b155855e0f09f3808bb1263aa4d20e67b3442ad58e455c327d0a90c9e81660416abd273d4cf4e02691c7f3e0d10654dc3cd2dcb32

Download Submit
memory/1180-139-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/1180-141-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1180-142-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/1440-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1440-140-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download