84fe0ea4048f95903ebe8692d1ce80c8db35205a8409eb0471f0dd78cb5fe471

Analysis

max time kernel
150s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2023 08:38

Target

ZOOKAgentSetup.exe
Size

5.9MB
MD5

c20aabde16ac81d65fbea5a169ed7a2d
SHA1

a48b94093249502621a0bccda2d4eabfde45da8a
SHA256

84fe0ea4048f95903ebe8692d1ce80c8db35205a8409eb0471f0dd78cb5fe471
SHA512

e27266a0a763975ed2d767abeb94f0c47da0c71f2a58d5eaf159180c38a7f1d8d4e5a20eaa79e618c344a00cd6f3a83ab549965fa991bd50361081d6fa25aa2e
SSDEEP

98304:fo1TPwHdnlRlaWc/KiU3oNzu8WoFcmRA3gTNVl1WxTMzz3uZr7pGvy9bpXPwxbBR:QC9UzU3cWobGgTV1ah7R9bpEyZ/E

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3988	ZOOKAgentSetup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 3988	3080	ZOOKAgentSetup.exe	85
PID 3080 wrote to memory of 3988	3080	ZOOKAgentSetup.exe	85
PID 3080 wrote to memory of 3988	3080	ZOOKAgentSetup.exe	85

C:\Users\Admin\AppData\Local\Temp\ZOOKAgentSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ZOOKAgentSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Users\Admin\AppData\Local\Temp\is-UC5U3.tmp\ZOOKAgentSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UC5U3.tmp\ZOOKAgentSetup.tmp" /SL5="$A0160,5922338,56832,C:\Users\Admin\AppData\Local\Temp\ZOOKAgentSetup.exe"
  2⤵
  - Executes dropped EXE
  PID:3988

C:\Users\Admin\AppData\Local\Temp\is-UC5U3.tmp\ZOOKAgentSetup.tmp

Filesize
695KB

MD5
e0ae0a667d7b126207dd6b4ed73b2143

SHA1
9ff30b267c392cd37ff4aa14a7fb6ca19429ec80

SHA256
4aa3ecc9847b49618a9b72fc528400df93a10fb33b607960397176f5aefd0e0d

SHA512
e4a24464a1c8b046b857031c0518babe62bf6e9d26a79e75d6303d1c9e742fe31e036e62f0558ad3d489c15c7f790befc8529cd6884cf44ce2b16b624454973f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UC5U3.tmp\ZOOKAgentSetup.tmp

Filesize
695KB

MD5
e0ae0a667d7b126207dd6b4ed73b2143

SHA1
9ff30b267c392cd37ff4aa14a7fb6ca19429ec80

SHA256
4aa3ecc9847b49618a9b72fc528400df93a10fb33b607960397176f5aefd0e0d

SHA512
e4a24464a1c8b046b857031c0518babe62bf6e9d26a79e75d6303d1c9e742fe31e036e62f0558ad3d489c15c7f790befc8529cd6884cf44ce2b16b624454973f

Download Submit
memory/3080-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3080-145-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3988-140-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/3988-147-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3988-148-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download