8ffc45ed98a4e16a0e2e58eb9e35f6f73a3a7520adb2e7e9360d7acead3a5f8c

Analysis

max time kernel
143s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2023, 20:01

Target

Decent_Sampler-1.8.12.0-Windows.exe
Size

31.7MB
MD5

1fb5e8893336b758740944ea0f2965a8
SHA1

8a849d422806fac01693ef44402bdf9ec14d34ba
SHA256

8ffc45ed98a4e16a0e2e58eb9e35f6f73a3a7520adb2e7e9360d7acead3a5f8c
SHA512

61acb91b0eaeb452604bcddf3004c37aafdd01d89b9532b40a4471a975414c3531eff9ae43243b1ccc418b64e59c5ae8d4bcebb6a7a0cd9874a7274d6537b44d
SSDEEP

786432:t+CMjkyOX0+Q/JQViulnYrsDDc4u3Mwh1+G1opCMi2KH:5GLGkWViu6I3Fw04oQMi

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4080	Decent_Sampler-1.8.12.0-Windows.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4080	4168	Decent_Sampler-1.8.12.0-Windows.exe	86
PID 4168 wrote to memory of 4080	4168	Decent_Sampler-1.8.12.0-Windows.exe	86
PID 4168 wrote to memory of 4080	4168	Decent_Sampler-1.8.12.0-Windows.exe	86

C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe
"C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\is-440OE.tmp\Decent_Sampler-1.8.12.0-Windows.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-440OE.tmp\Decent_Sampler-1.8.12.0-Windows.tmp" /SL5="$F00FA,32361468,831488,C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"
  2⤵
  - Executes dropped EXE
  PID:4080

C:\Users\Admin\AppData\Local\Temp\is-440OE.tmp\Decent_Sampler-1.8.12.0-Windows.tmp

Filesize
3.0MB

MD5
bbd72aa568e9f2c3e67f5c6db24e9d3e

SHA1
5a6bbbcfaac32e7ad3d25d77f65efd3794cc83d3

SHA256
ee8b8339f58e9ac39efe9b27c29bf9b5a6f09028f231c2f5f7e671760ee8622e

SHA512
f94abb0e5bb0829472db638b5ec846e5580ec792fe0f21be6ea2745aa2c87b7a1782111dafb5350b2089bf672fcdfd08059d750ce87f2448761c95c983e14741

Download Submit
memory/4080-139-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/4080-142-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/4080-143-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/4168-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4168-141-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download