fab497d5b4df99ec0c1e41acc95562f296723de1968b0edf043337789f849795

Analysis

max time kernel
203s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 10:38

Target

PrismLauncher-Windows-MSVC-Setup-7.2.exe
Size

16.5MB
MD5

1a51c8789555c0add60b17c406ba4f8b
SHA1

34581826221ccb7035487e0de99841e5686b281a
SHA256

fab497d5b4df99ec0c1e41acc95562f296723de1968b0edf043337789f849795
SHA512

8b6cfc003e3bcb972a6acab2dee9fadbb1c38db7354f6b9686cb74d2089990ba2a235c4da202d51431c8d618fb1b176018dcc74844f467aec2e01e0340217cdd
SSDEEP

393216:w6ndeJcPr6E0XoglOKARMv9CtzxTVwRNniKoBEBdCaINFc/tGZKfH:w09mCRMv9czxZwPauDyfYH

Score

4^/10

Loads dropped DLL 1 IoCs

pid	Process
1228	PrismLauncher-Windows-MSVC-Setup-7.2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-7.2.exe
"C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-7.2.exe"
1⤵
- Loads dropped DLL
PID:1228

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsv9E40.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit