82f5a693742c6c35f1280dbc5a4148598c129208dfc0544a5cd457b7ac8e824a

Analysis

max time kernel
292s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2023, 01:19

Target

Setup_WinThruster_2024.exe
Size

7.3MB
MD5

62f9258f3ae4774f9dc169a2a0b1d68e
SHA1

56164f50722724275c0db381235d3b793f85acd5
SHA256

82f5a693742c6c35f1280dbc5a4148598c129208dfc0544a5cd457b7ac8e824a
SHA512

ef04a48d957d646e0b4fbdb68bfe59bedfb6f5701dd9497b2bc5abeea57b5d7be5f8694ca59d535c8d14514ecacfb6773476abcd3d2f65a1da7c0c75241d7fd2
SSDEEP

98304:cSi3CpUYtyBI5sdXR/YVTWXumt2Q7VJedSNtjrk8rNF3y0HWRR4cmWDjzK45:IClt4I+yTd2rJzrjr7H3r2R2qHb

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
848	Setup_WinThruster_2024.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 848	4116	Setup_WinThruster_2024.exe	90
PID 4116 wrote to memory of 848	4116	Setup_WinThruster_2024.exe	90
PID 4116 wrote to memory of 848	4116	Setup_WinThruster_2024.exe	90

C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\is-UIAM2.tmp\Setup_WinThruster_2024.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UIAM2.tmp\Setup_WinThruster_2024.tmp" /SL5="$501F0,6737092,878080,C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe"
  2⤵
  - Executes dropped EXE
  PID:848

C:\Users\Admin\AppData\Local\Temp\is-UIAM2.tmp\Setup_WinThruster_2024.tmp

Filesize
696KB

MD5
be0b0fed218ec0ff9fea3d8747f896e6

SHA1
947890a95847863e33c67e6714d0313dd6727fb5

SHA256
b5d1548c4ea027e296459b0a10138026aa15eb6560ecebd9923de77816adefba

SHA512
97fd0621e0a81b59b1e9738a544fc90f177cb240d4604960a0cc2d47d517cf5e8a23d49fae61774a4f3e381959c19eb19432716bd5dffb62e29aa0306cb976f2

Download Submit
memory/848-6-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/848-11-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/848-14-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/4116-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4116-2-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4116-10-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download