ba014ec4ead7332889e2fb12fcd7806183b254b3e32dd02c5bec81b73478d94a

Analysis

max time kernel
141s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2023, 07:01

Target

SetupPayServ2_JKOS.exe
Size

3.0MB
MD5

5145df523d499dbeefd1b8693a1ebd75
SHA1

7ac080250d25c9e8439d8e018efb5b5234d744ca
SHA256

ba014ec4ead7332889e2fb12fcd7806183b254b3e32dd02c5bec81b73478d94a
SHA512

dc8b2f2bb623fa2925212ca1b4481191d828ab9314ad3b11e0015ec8e2d956069456c5b195c14723f5d6bf297776dc4d7d119fddfbb19e1b67ca290512b3a33e
SSDEEP

98304:RGLmvHn5U3IAfn180Dy8QMDWHFWrT6uf0Jo:wmvHnYv180DsuWlWf6us6

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3924	SetupPayServ2_JKOS.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3924	3100	SetupPayServ2_JKOS.exe	86
PID 3100 wrote to memory of 3924	3100	SetupPayServ2_JKOS.exe	86
PID 3100 wrote to memory of 3924	3100	SetupPayServ2_JKOS.exe	86

C:\Users\Admin\AppData\Local\Temp\SetupPayServ2_JKOS.exe
"C:\Users\Admin\AppData\Local\Temp\SetupPayServ2_JKOS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\AppData\Local\Temp\is-O5IDF.tmp\SetupPayServ2_JKOS.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O5IDF.tmp\SetupPayServ2_JKOS.tmp" /SL5="$501D4,2794108,119296,C:\Users\Admin\AppData\Local\Temp\SetupPayServ2_JKOS.exe"
  2⤵
  - Executes dropped EXE
  PID:3924

C:\Users\Admin\AppData\Local\Temp\is-O5IDF.tmp\SetupPayServ2_JKOS.tmp

Filesize
1.1MB

MD5
6a96bef4679e16a54b4090e74664dcca

SHA1
c8631c1624b98f6709b1ac37ce3956faed29bc30

SHA256
cb095356ddcfcbace96c6252fb73a267ed011c15ff206a7a9302007baa68a783

SHA512
924ab1e5c6ea72342eab6e78899a56c415e90020c46d3d8a81ae4da9276db7ea1df9684965a81fb95a6f2f9cf103b31413d67770eb15725ad04198c5d00037d0

Download Submit
memory/3100-134-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3100-144-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3924-139-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/3924-146-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3924-147-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download