2f27fcc7688ff2b8f2f66c378baf7d8c1d326d76c1da2bad70934b3773e22748

Analysis

max time kernel
166s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 11:57

Target

SetPSX.exe
Size

507KB
MD5

3f9a8e7664ab4aff25c68d1398713ccf
SHA1

81cb9c2efe3e6b1040dbc066592489e4f9cc81cf
SHA256

2f27fcc7688ff2b8f2f66c378baf7d8c1d326d76c1da2bad70934b3773e22748
SHA512

7dc1640d6718ebc3ba7e1646ff2f057e93e297569a25b091ff9b4e0f3afc2cf917110cfb25032a756e435c90c6b36432ce7149bb0e920fba07c69d04f38d2599
SSDEEP

12288:0adLWDa888888888888W888888888887GKr9pamPmpQnQYwu4FKxd97maMKf+zIb:TBWSGKPn/wu4FYdMasW6k

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4444	SetPSX.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4444	3576	SetPSX.exe	86
PID 3576 wrote to memory of 4444	3576	SetPSX.exe	86
PID 3576 wrote to memory of 4444	3576	SetPSX.exe	86

C:\Users\Admin\AppData\Local\Temp\SetPSX.exe
"C:\Users\Admin\AppData\Local\Temp\SetPSX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Users\Admin\AppData\Local\Temp\is-N0LGJ.tmp\SetPSX.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N0LGJ.tmp\SetPSX.tmp" /SL5="$5017E,120832,0,C:\Users\Admin\AppData\Local\Temp\SetPSX.exe"
  2⤵
  - Executes dropped EXE
  PID:4444

C:\Users\Admin\AppData\Local\Temp\is-N0LGJ.tmp\SetPSX.tmp

Filesize
1.1MB

MD5
ff893b049c96ab77898df24f23364cb9

SHA1
516ea03f1104e10c7d3a4e50c5051f7b05a757bb

SHA256
9e3ee451ada254a580ff5e2525b51c6f16dbb8c437c559da3adfd52f2692263a

SHA512
94047e206c86e488e2e66ba5fd79bac85ffbca5922e544bccd16e08f11c5e530dcd37ee81b836ad38700e29734c75acd788fd7482aab4ae467266164ee3e23a1

Download Submit
memory/3576-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3576-141-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3576-144-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4444-142-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/4444-145-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/4444-147-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download