2b4ae19913ee3d15751b95d05c1efe794c174e802d0a352fed333c2a6396fd1e

Resubmissions

07-08-2023 14:12

07-08-2023 14:09

07-08-2023 14:03

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2023 14:09

Target

ProtonVPN_v3.0.7.exe
Size

74.2MB
MD5

4205260ed66ce9e31f8c4b6b6ddc0d2f
SHA1

c11fd487094820a0c87399477638a6da56fba6e8
SHA256

2b4ae19913ee3d15751b95d05c1efe794c174e802d0a352fed333c2a6396fd1e
SHA512

976b29a7442f179df10fa23c4b00746097334a63f0e74956c71fca443cf3f0ec282cb7a46759b178d09f46aedc450f11afa62b3219261bf221a20e36d531183b
SSDEEP

1572864:TjIr5oRymmju9NtSokfOYHWoaWa2QtDoGV3TEoUxf:3Ir59KNtSoDm8jFoGVjE3

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
1108	ProtonVPN_v3.0.7.tmp

Loads dropped DLL 1 IoCs

pid	Process
1108	ProtonVPN_v3.0.7.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1108	4580	ProtonVPN_v3.0.7.exe	80
PID 4580 wrote to memory of 1108	4580	ProtonVPN_v3.0.7.exe	80
PID 4580 wrote to memory of 1108	4580	ProtonVPN_v3.0.7.exe	80

C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.0.7.exe
"C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.0.7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\is-PIDL3.tmp\ProtonVPN_v3.0.7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PIDL3.tmp\ProtonVPN_v3.0.7.tmp" /SL5="$501D0,76841621,1089536,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.0.7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1108

C:\Users\Admin\AppData\Local\Temp\is-PIDL3.tmp\ProtonVPN_v3.0.7.tmp

Filesize
3.3MB

MD5
49ae5a0ec56b59f2ebffae7f37491fd7

SHA1
3c039d124392560762b0bb56dc5da58b3d3a27d5

SHA256
d4895ce6cbe8326b9cd1d25fd01b439ec01efbdf87dec4553e4902d0dc06c0e3

SHA512
3c451bda12e87ba3ff674c79ba0dbc38c98a97551833807b84a0cf4b659fc4ce92f270903f32edc0bcc343fa64ebbb00a2246e47795e32a71b3db65aeee77fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TG2IR.tmp\ProtonVPN.InstallActions.x86.dll

Filesize
576KB

MD5
9b1f5e4bb10426e1427dfb2bf00dfca1

SHA1
195ea4e0555684b8879954e1c105bbd0911dc599

SHA256
5fd0fddd559120e93501e4eea4050a51f116858c0d35d1eaf1c91ba181532776

SHA512
bbfef05ca1da478d5680b08be1f59d84335709d3691260f88b4a9f5167c0f9b532af7f11bdfa1fb0d4d16ce65a29de821aa823da0806648b09746827ad4578df

Download Submit
memory/1108-139-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/1108-142-0x0000000002590000-0x00000000026D0000-memory.dmp

Filesize
1.2MB

Download
memory/1108-147-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/1108-148-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/4580-134-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/4580-146-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download