19c1a376ad5ae315051dcad5854c47578a30b9652de8ecc31036e46228fcd08c

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 00:34

Target

DiscordTokenProtectorSetup.exe
Size

3.7MB
MD5

af122b9c5d0352e4899ae23c2b43273b
SHA1

29991fc967f7597a25148d534136104d33f13458
SHA256

19c1a376ad5ae315051dcad5854c47578a30b9652de8ecc31036e46228fcd08c
SHA512

c524f66fb1d56e880dbc7d75a608008d57caf818094565f563a4a8ebb5bf009c2aba6c5287e6af2c94b23c9c5bf1320503c6117d995a43bba859c0073fe17788
SSDEEP

98304:YkLGbgKE6gQypQkAqebChM8gnKTJYyFEu:HYESypuqe+mVnXkEu

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2288	DiscordTokenProtectorSetup.tmp

Loads dropped DLL 1 IoCs

pid	Process
1248	DiscordTokenProtectorSetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2288	1248	DiscordTokenProtectorSetup.exe	28
PID 1248 wrote to memory of 2288	1248	DiscordTokenProtectorSetup.exe	28
PID 1248 wrote to memory of 2288	1248	DiscordTokenProtectorSetup.exe	28
PID 1248 wrote to memory of 2288	1248	DiscordTokenProtectorSetup.exe	28
PID 1248 wrote to memory of 2288	1248	DiscordTokenProtectorSetup.exe	28
PID 1248 wrote to memory of 2288	1248	DiscordTokenProtectorSetup.exe	28
PID 1248 wrote to memory of 2288	1248	DiscordTokenProtectorSetup.exe	28

C:\Users\Admin\AppData\Local\Temp\DiscordTokenProtectorSetup.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordTokenProtectorSetup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\is-6AMBI.tmp\DiscordTokenProtectorSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6AMBI.tmp\DiscordTokenProtectorSetup.tmp" /SL5="$50150,3044394,782336,C:\Users\Admin\AppData\Local\Temp\DiscordTokenProtectorSetup.exe"
  2⤵
  - Executes dropped EXE
  PID:2288

C:\Users\Admin\AppData\Local\Temp\is-6AMBI.tmp\DiscordTokenProtectorSetup.tmp

Filesize
3.0MB

MD5
622be36d4de55c9b2793c670111e0d2a

SHA1
83786fadbc6033fb69aca92c4bd1957963c98ad9

SHA256
f5eadb7e925bfb4a777bd98be9d214490953d1a40c497025b7bb8bdebc30e287

SHA512
8448e160f85343dad4a9ea5cf58fb23f708117583247cb50f65c83e806c458605e5a5dd6735fbf51486711ed41ebcca71393230c875d43ed2dd6b0227e2acb1b

Download Submit
\Users\Admin\AppData\Local\Temp\is-6AMBI.tmp\DiscordTokenProtectorSetup.tmp

Filesize
3.0MB

MD5
622be36d4de55c9b2793c670111e0d2a

SHA1
83786fadbc6033fb69aca92c4bd1957963c98ad9

SHA256
f5eadb7e925bfb4a777bd98be9d214490953d1a40c497025b7bb8bdebc30e287

SHA512
8448e160f85343dad4a9ea5cf58fb23f708117583247cb50f65c83e806c458605e5a5dd6735fbf51486711ed41ebcca71393230c875d43ed2dd6b0227e2acb1b

Download Submit
memory/1248-1-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1248-10-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2288-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2288-12-0x0000000000400000-0x0000000000707000-memory.dmp

Filesize
3.0MB

Download
memory/2288-13-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download