7e6c688284c875af8f1baf2e483effe078cb9c23ac34e3ccc23b5b93901d2bdc

Resubmissions

29/06/2023, 06:00

29/06/2023, 05:09

max time kernel
150s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 05:09

Target

Fighting is Magic Aurora Setup.exe
Size

928.5MB
MD5

32653c4f154ff8d9a24074a80ecd4b1a
SHA1

ab44cc244ca88907c27b26a9bba6b0d1739bcaf9
SHA256

7e6c688284c875af8f1baf2e483effe078cb9c23ac34e3ccc23b5b93901d2bdc
SHA512

5c7e173cdae10c18750e335635efcb091d80ee4e8c47cf24c5746ce1d87991716a32429d62ffcefa4a7993a4fb1b8779137cec924d1d2d2f9eb63c1145873489
SSDEEP

25165824:cTZcewrHZldTCDTtzRkfpFWDvKOsPWrRKh3ekYcA:cC5rZjCDZzOfiKzPKm3ekM

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3836	Fighting is Magic Aurora Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3836	2876	Fighting is Magic Aurora Setup.exe	89
PID 2876 wrote to memory of 3836	2876	Fighting is Magic Aurora Setup.exe	89
PID 2876 wrote to memory of 3836	2876	Fighting is Magic Aurora Setup.exe	89

C:\Users\Admin\AppData\Local\Temp\Fighting is Magic Aurora Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Fighting is Magic Aurora Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\is-M8JEB.tmp\Fighting is Magic Aurora Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M8JEB.tmp\Fighting is Magic Aurora Setup.tmp" /SL5="$A0040,973271813,78848,C:\Users\Admin\AppData\Local\Temp\Fighting is Magic Aurora Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:3836

C:\Users\Admin\AppData\Local\Temp\is-M8JEB.tmp\Fighting is Magic Aurora Setup.tmp

Filesize
717KB

MD5
09fd8f2837599c61c6c94caf355d4210

SHA1
fa2d8ad8176762e36c6aae571b7d9eab3d460ccd

SHA256
a1f087c1bb7d07603e81e03d36232e1e753b6aaccb9bdcaa9753559fc6dd5c28

SHA512
ded4c87428b708848cc121b98d1dfcda0587b4dfe995b8cfb7dc7fbe4c138d4de1bf76e480e9ce4d9781823310538de5c03dfd29d21ca208923f5d5e0f1f64c0

Download Submit
memory/2876-133-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2876-140-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3836-139-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/3836-141-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3836-142-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download