20739f8c131cffdedb5405d6c5be6c4bc6ad6b81a8ddecfa77589cf376ddb555

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2023 08:15

Target

setup.exe
Size

3.6MB
MD5

002247f32f0e872ff49e942af8c03456
SHA1

7feb5b75364a96cafb33055366ea326277332383
SHA256

20739f8c131cffdedb5405d6c5be6c4bc6ad6b81a8ddecfa77589cf376ddb555
SHA512

2eff240f26edafbe79c561a64aeee49da777073918cef7f98d25b6768718dc6f8c710ee493c0083e5d028f7b39f750c98eb61ff0b3576f066b364c02d18f351c
SSDEEP

98304:Z9u3lllb+hb1oFj6seR8NrRV4DP5tj6RRTrLs+MsfUXAaIJ/iOp1X:4FaCdva8NtgRtj6Rq1KKOpB

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3656	setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3656	4908	setup.exe	84
PID 4908 wrote to memory of 3656	4908	setup.exe	84
PID 4908 wrote to memory of 3656	4908	setup.exe	84

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\is-BCT9R.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BCT9R.tmp\setup.tmp" /SL5="$A0152,3566837,58368,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  PID:3656

C:\Users\Admin\AppData\Local\Temp\is-BCT9R.tmp\setup.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
memory/3656-139-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/3656-141-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4908-133-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4908-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download