Analysis
-
max time kernel
364s -
max time network
309s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 22:36
Static task
static1
Behavioral task
behavioral1
Sample
ShareX-15.0.1.247-setup.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
ShareX-15.0.1.247-setup.exe
Resource
win10v2004-20231023-en
General
-
Target
ShareX-15.0.1.247-setup.exe
-
Size
38.0MB
-
MD5
c3e1ed2272cdee364ae9bc44416f9aaa
-
SHA1
f59dd715356962a6aecad106d98bf03d877dc363
-
SHA256
45a98ef3dd7deeb1482f9947478d1b3b0f557ac97da9daf07cdb178dc643574b
-
SHA512
f1f00247dc4016936591b1c3b829db7b5b178e570903cbe8c7f635a55d5af416f35ba3c8ff8358819d6d43c124accbe19514935c30d04d23adbab2d75c6dc14f
-
SSDEEP
786432:HBBChzrCK3e2DiJrchbvnFPPlbaYgBGjbl+wxvECCuW+R3pcKLmVuEb:HTYzrCWhbPFleYgBGjB+wZcuW+JpcWmn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3648 ShareX-15.0.1.247-setup.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2008 wrote to memory of 3648 2008 ShareX-15.0.1.247-setup.exe 90 PID 2008 wrote to memory of 3648 2008 ShareX-15.0.1.247-setup.exe 90 PID 2008 wrote to memory of 3648 2008 ShareX-15.0.1.247-setup.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ShareX-15.0.1.247-setup.exe"C:\Users\Admin\AppData\Local\Temp\ShareX-15.0.1.247-setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\is-7TTGH.tmp\ShareX-15.0.1.247-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7TTGH.tmp\ShareX-15.0.1.247-setup.tmp" /SL5="$401F8,39009769,832512,C:\Users\Admin\AppData\Local\Temp\ShareX-15.0.1.247-setup.exe"2⤵
- Executes dropped EXE
PID:3648
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5241e4352ea52a1b3bede8a71d9750f0c
SHA142d1531957d3c2547c73ca683e723bfc13d338fd
SHA256fc904a2909a5699e7b4680f09ada00ac2bef124447e45b9db91e53a5e4636f36
SHA51268fb9f533bb9cab81bf068291a1b40464fafc7b43e72a16232f07e81c7cb75b6c5ac40ec3a40dabfc88fd16732d102e7d14cfc1ac016cfccd24ccf1019295b4b