0bbd331844ce9e5fc21c36d051691bc8854463487b028aec6445208dc0748190

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2023, 21:13

Target

飞机tsetup.2.2.0.exe
Size

21.5MB
MD5

11c2cfe1c1bef349b2e2235c9d3cf2c5
SHA1

0294a3a1169d687b8c3443a2027240770ee08490
SHA256

0bbd331844ce9e5fc21c36d051691bc8854463487b028aec6445208dc0748190
SHA512

7a14f040a1e52f6cddd281aac904567a8665bf5583d0c3681b6e57d99a32f2a16040f0f916a4f1047bb8854669199a4713ce713c337aa28b127d17d6e21e038b
SSDEEP

393216:OD2JdO61ZhB1DoUjkGb66oEH9W3WS/knEC5xVbGZP/JwHxCmL7mySRsAdJ19:OqY6xjjL6WH9W3WS/QH5x5GZPGHxCm+v

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
1192	飞机tsetup.2.2.0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1192	2660	飞机tsetup.2.2.0.exe	81
PID 2660 wrote to memory of 1192	2660	飞机tsetup.2.2.0.exe	81
PID 2660 wrote to memory of 1192	2660	飞机tsetup.2.2.0.exe	81

C:\Users\Admin\AppData\Local\Temp\飞机tsetup.2.2.0.exe
"C:\Users\Admin\AppData\Local\Temp\飞机tsetup.2.2.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\is-NNL5U.tmp\飞机tsetup.2.2.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NNL5U.tmp\飞机tsetup.2.2.0.tmp" /SL5="$E0054,22115366,486912,C:\Users\Admin\AppData\Local\Temp\飞机tsetup.2.2.0.exe"
  2⤵
  - Executes dropped EXE
  PID:1192

C:\Users\Admin\AppData\Local\Temp\is-NNL5U.tmp\飞机tsetup.2.2.0.tmp

Filesize
1.5MB

MD5
51dbb99cac2b3e1e2b07e61a68f5d826

SHA1
230b70ebc4ed6a1fa909e641dba967a1a7f007e7

SHA256
b3fadc5f772363fd0ceb6e4a706b7c0aa9e3c50945ae664d538ec8af696b6057

SHA512
073c106b586ea63d23224ea3d6808cf149d40e20c241dce449c69beb94cf8a303915776a539a3f1d4da3c67b2e4da7d238ff2357238604759f990d8737efcba3

Download Submit
memory/1192-139-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/1192-142-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1192-143-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2660-134-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2660-141-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download