e22c790e2bd9220a36ecf63dbe334c1d1c4c22b15d26901e9ca9d2b016c8cf16

Analysis

max time kernel
172s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 03:40

Target

Setup-RemoteAppClient.exe
Size

7.7MB
MD5

3a9a2126af4e4911651942ded3912053
SHA1

0aaef20576292ea48fde0ba6947b13a86a80c7d0
SHA256

1f6058572fddd6b35a03d340e115614d64c963ffc1b73a4a88f219934699ffee
SHA512

13e7302005567f9563d1eec1715cb1ca1b09c08bdb24b79a280725960ef341fa2db12cc38b8110df9a954b200d034ce6b17a68834bdf51b5acb9d4dc48da6376
SSDEEP

196608:1acJdFhxHtlxK1hS+TcpG1+c4dpG3subKx7hy:1TFLI1hCg+fDuay

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
1820	Setup-RemoteAppClient.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1820	4068	Setup-RemoteAppClient.exe	86
PID 4068 wrote to memory of 1820	4068	Setup-RemoteAppClient.exe	86
PID 4068 wrote to memory of 1820	4068	Setup-RemoteAppClient.exe	86

C:\Users\Admin\AppData\Local\Temp\Setup-RemoteAppClient.exe
"C:\Users\Admin\AppData\Local\Temp\Setup-RemoteAppClient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\is-9LBIB.tmp\Setup-RemoteAppClient.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9LBIB.tmp\Setup-RemoteAppClient.tmp" /SL5="$5011A,7155010,940544,C:\Users\Admin\AppData\Local\Temp\Setup-RemoteAppClient.exe"
  2⤵
  - Executes dropped EXE
  PID:1820

C:\Users\Admin\AppData\Local\Temp\is-9LBIB.tmp\Setup-RemoteAppClient.tmp

Filesize
3.1MB

MD5
9debfe936a475df53f3587bb2f2224c5

SHA1
8040368591f647c15b6670e41bec082db3100b47

SHA256
3c70e26e055646494821a0203c81c506953d407f98961dd90647abcd1839bb4a

SHA512
35accf83ca82846504faf2836227d5a57751dda227239c37e460eacd662d5b710f656c8d445a6677a93131c6172ce9462fe5643b4c0eab37ecd49471dcb4490f

Download Submit
memory/1820-6-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/1820-8-0x0000000000400000-0x000000000072D000-memory.dmp

Filesize
3.2MB

Download
memory/4068-1-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4068-7-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download