48b86a47f4b47501f0bd263f21da63851277782a5750f41a52a656effa302118

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 16:23

Target

Setup.exe
Size

6.6MB
MD5

d3a804d3680c4355d0464e33903a0f85
SHA1

6399faa1cc183dc00e2fcd15463e964b35c0c74c
SHA256

48b86a47f4b47501f0bd263f21da63851277782a5750f41a52a656effa302118
SHA512

116112c187012f04f979b441f2b057230209e8919d42a9490b66290e8a651512eb38702577a46cc225cdc6592c753251bb54dc01501d38dc9aecaf968c997cec
SSDEEP

49152:hBuZrEUtnw9fSJ9R1WRaSL1mmvpFJW8M7r59uNA9jFzvqXZ831X333BC:HkLpqS/+v219eA9jFzvt3338

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3600	Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 3600	2228	Setup.exe	86
PID 2228 wrote to memory of 3600	2228	Setup.exe	86
PID 2228 wrote to memory of 3600	2228	Setup.exe	86

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\is-CFOP3.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CFOP3.tmp\Setup.tmp" /SL5="$701D4,886784,0,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:3600

C:\Users\Admin\AppData\Local\Temp\is-CFOP3.tmp\Setup.tmp

Filesize
3.1MB

MD5
36c6f16040eb09509ffd9822af9a10cf

SHA1
cc5c0a772d339b9d8beaf56afff7571c151d7614

SHA256
f42d7956e66cc961f2bfc276568ccd771ccdcad8da3f03665aa29db8367cda90

SHA512
1a707348b3d3d2188c7473904d189b2034a8f72e6418cd1c2b66f8dd73dde3922a3486aa572d6e0dc05d563881e0980037fc0b225f6ef9a413b421d59f46a12d

Download Submit
memory/2228-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2228-7-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/3600-5-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/3600-8-0x0000000000400000-0x0000000000720000-memory.dmp

Filesize
3.1MB

Download
memory/3600-9-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download