db2091ac5e1c232366b37946ecc3b7df751bc98669791389c49cd137e9c8ebc1

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 09:51

Target

Firebird-4.0.3.2975-0-x64.exe
Size

25.0MB
MD5

939acbf2a8761e004b3afe73c3bbd8c0
SHA1

fabeda411fce988644ab5fbe728777dd3b001614
SHA256

db2091ac5e1c232366b37946ecc3b7df751bc98669791389c49cd137e9c8ebc1
SHA512

c6b8cf3794dc03542fb7b545eb2be2a602354566b7af5f450d1fe4b8190a49da081da2e627a6865b26727188509810420c811b5c987b2156f6d287537d77ddc3
SSDEEP

393216:JlmK7vQ0uUtXgiUwkya8jls56rj2yhc/1cUzZ3xLJh0ZxY9awQaGfo1hhba5hU:Jll7FtX3ljW56+yoPzZBaYQwQlw7hCi

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3780	Firebird-4.0.3.2975-0-x64.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3780	4788	Firebird-4.0.3.2975-0-x64.exe	80
PID 4788 wrote to memory of 3780	4788	Firebird-4.0.3.2975-0-x64.exe	80
PID 4788 wrote to memory of 3780	4788	Firebird-4.0.3.2975-0-x64.exe	80

C:\Users\Admin\AppData\Local\Temp\Firebird-4.0.3.2975-0-x64.exe
"C:\Users\Admin\AppData\Local\Temp\Firebird-4.0.3.2975-0-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\is-BLSAD.tmp\Firebird-4.0.3.2975-0-x64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BLSAD.tmp\Firebird-4.0.3.2975-0-x64.tmp" /SL5="$60148,25323650,832512,C:\Users\Admin\AppData\Local\Temp\Firebird-4.0.3.2975-0-x64.exe"
  2⤵
  - Executes dropped EXE
  PID:3780

C:\Users\Admin\AppData\Local\Temp\is-BLSAD.tmp\Firebird-4.0.3.2975-0-x64.tmp

Filesize
3.0MB

MD5
212f4353b6e2bcc74e8f6e9eeadeab2a

SHA1
a6e8e23db9f344b80b20afa2b4917706d7655c7c

SHA256
147e6cd5071af9b3437b34259e0f7d67732c93c8640919cd75192871e8c4ee85

SHA512
bd2cd15fe846b55d5bf3377ce0f993fee9ee77ec133793f1b0aff1204b2af0c8333ba715c6839b4d0213ef80ea31aa556e8fc4c36a52fc73ae5abb071fa6b112

Download Submit
memory/3780-6-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/3780-9-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/3780-10-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/4788-1-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4788-8-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download