b5d683e0f613993f4cb13df31a212c1e899fe5e64db5e7e9c3b89c0a26a1948a

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2023 18:21

Target

Setup_WinThruster_2024.exe
Size

7.3MB
MD5

31de300c38802ca43c76791fbd9188ca
SHA1

15ef23d6b99e12f4211b5725e0d82d66047e4031
SHA256

b5d683e0f613993f4cb13df31a212c1e899fe5e64db5e7e9c3b89c0a26a1948a
SHA512

67a86e0611e9c9482989237310fe9357e1aaf938a48577cec1cd2196eb756a6aa45369c88fb21000b57f4e14083c165169c4d9b5682fdd526758a9125289765a
SSDEEP

98304:PSiARkjZT+L9iSXS/YdisnD7Jxm36C5F5nLZzy/FyBBhRazbNF3y0HWRR4GyzWDK:gJpC/YdyRnnLZzyAL633r2R2GySHG

Score

4^/10

Executes dropped EXE 1 IoCs

Processes:

Setup_WinThruster_2024.tmp

pid process

3412 Setup_WinThruster_2024.tmp

pid	process
3412	Setup_WinThruster_2024.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Setup_WinThruster_2024.exe

description	pid	process	target process
PID 3608 wrote to memory of 3412	3608	Setup_WinThruster_2024.exe	Setup_WinThruster_2024.tmp
PID 3608 wrote to memory of 3412	3608	Setup_WinThruster_2024.exe	Setup_WinThruster_2024.tmp
PID 3608 wrote to memory of 3412	3608	Setup_WinThruster_2024.exe	Setup_WinThruster_2024.tmp

C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\AppData\Local\Temp\is-96LFM.tmp\Setup_WinThruster_2024.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-96LFM.tmp\Setup_WinThruster_2024.tmp" /SL5="$4021A,6727578,878080,C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe"
  2⤵
  - Executes dropped EXE
  PID:3412

C:\Users\Admin\AppData\Local\Temp\is-96LFM.tmp\Setup_WinThruster_2024.tmp

Filesize
3.1MB

MD5
6bc8ee30409d02eca54e86f70365bd0f

SHA1
d104483b106a0f72cbf87d276701e2c821af9cc6

SHA256
fcf6ee9084abc98fa2706c394ec7ce8099567d8a86a9d060b7364827d2a3b8da

SHA512
995ca38260feba8d5856c2c4843e72d55fb8286870600657be8c51b37524f080e8c9f7a3a5345778e703b8d8cffe8439a2cb96548c2f2124d5e490826b1c7417

Download Submit
memory/3412-6-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/3412-11-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/3412-12-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/3608-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3608-10-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download