3212aa98f6c8d67aa997a074578010b36d3df5d1a6d2055f5434ba8632fc260e

Analysis

max time kernel
163s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 22:25

Target

fdm_x64_setup.exe
Size

34.0MB
MD5

ca2ead342a22fcd891f73f99cba91005
SHA1

6e6470b49e9e9791acc6854b3d3823e97b058407
SHA256

3212aa98f6c8d67aa997a074578010b36d3df5d1a6d2055f5434ba8632fc260e
SHA512

39e8e285f3bc169ce3306cecf7a06317a93126dfce2d128acbb0a82d693d98ba0297601e258e4fa48ab8d2f235c6f8b5b648b48f15c02022e22893095a470bc6
SSDEEP

786432:5fzVFV7zFAsPBoyK32MlH8CSC9xSWEjh/dlCBS1Y/qemqa:/fWyKGMlcnelEdlO0YLa

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

fdm_x64_setup.tmp

pid process

1768 fdm_x64_setup.tmp

pid	process
1768	fdm_x64_setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fdm_x64_setup.exe

description	pid	process	target process
PID 2040 wrote to memory of 1768	2040	fdm_x64_setup.exe	fdm_x64_setup.tmp
PID 2040 wrote to memory of 1768	2040	fdm_x64_setup.exe	fdm_x64_setup.tmp
PID 2040 wrote to memory of 1768	2040	fdm_x64_setup.exe	fdm_x64_setup.tmp

C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\is-GU3SG.tmp\fdm_x64_setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-GU3SG.tmp\fdm_x64_setup.tmp" /SL5="$B005A,34943088,780288,C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"
2⤵
- Executes dropped EXE
PID:1768

C:\Users\Admin\AppData\Local\Temp\is-GU3SG.tmp\fdm_x64_setup.tmp

Filesize
2.5MB

MD5
869c50863faef0fa7052b5551698ed58

SHA1
feb12f73e0a68d43db51a35f04be3f9d2aac90a3

SHA256
7e49962115092d3709b9a3e68934972931bb900f23bf4b42ac90d250725e7d4e

SHA512
19076555396601758b0b62a9b9fc68bb96b83387c5a345c3e68f5794b67c45bec7905654fe1243e2daf3ae8fe11c2ad243e962633370535a7a3f41bcb7fec1df

Download Submit
memory/1768-6-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/1768-8-0x0000000000400000-0x0000000000682000-memory.dmp

Filesize
2.5MB

Download
memory/1768-9-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/2040-1-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2040-7-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download