a3c8ca44daf1998a1ada646b3759f6a62674f8bad6f194a64d4ec697ea8455ab

Analysis

max time kernel
152s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2023 20:50

Target

Setup.exe
Size

120.1MB
MD5

5fb9b3c109ad471d0bc148329344e8ca
SHA1

21f2a06e7f83cb2886c16cafc20968f370fa2643
SHA256

c9ae7f8a79a27955d93c32f1b9fc3100496f4cdb6acfa848e80acabca6d1749f
SHA512

b50c9420e0709391be280b4f65be35bde9018388872c4ad675f104fd0093be22159a74b0d46b0d1c92043887824cb97464db452d422bcd339a1f3578b3f7456c
SSDEEP

1572864:uiM7DhczCaxWLABs8spKCFLme+A2akcvAYBkbKiD5DEeM9VCwQdUzk+:ulOCaELAO8WLiA2aTVkbKidc9IdUz/

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Setup.tmp

pid process

4724 Setup.tmp

pid	process
4724	Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 4184 wrote to memory of 4724	4184	Setup.exe	Setup.tmp
PID 4184 wrote to memory of 4724	4184	Setup.exe	Setup.tmp
PID 4184 wrote to memory of 4724	4184	Setup.exe	Setup.tmp

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184

C:\Users\Admin\AppData\Local\Temp\is-14U0H.tmp\Setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-14U0H.tmp\Setup.tmp" /SL5="$A0226,124988605,836608,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
2⤵
- Executes dropped EXE
PID:4724

C:\Users\Admin\AppData\Local\Temp\is-14U0H.tmp\Setup.tmp

Filesize
2.5MB

MD5
d9bc11c23aa360311d6b237b23b0c4fd

SHA1
2f6bca0a9d09a1928f139a8a2e0cc872f4284fe7

SHA256
88e4053e376c6597edc6533584b2f2fa3905237fe5db61867e8ee71c3a9e9f5d

SHA512
732b217963e415fb272556731cf8503df431dbc450f6caf59b7c47804c650baebd33735d9fee18537bac37d639f4491a168351fa4b431457f62bae0e219de6fa

Download Submit
memory/4184-1-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/4184-10-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/4724-6-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/4724-11-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/4724-12-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download