cf7a36429c50dd79df0d2132dabd3492c7958f5ae4b8ef2a6fc15748ae7f6929

Analysis

max time kernel
141s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:43

Target

PCMTOSETUP_DEMO.exe
Size

3.2MB
MD5

183f3ffd2e2ed2f5cbb3e15f90bf879a
SHA1

af8518c5eadef192737647c87b26db5462f07985
SHA256

65fb025eab91b05a9f98413f1263b2280ed4aa6c06a62b82b4c34b3977a61ebf
SHA512

1656ad6e0bd133b6919512903c31434918cab2513304bd6549e092df02b7bc1dc1ab14702e039e44b524b4a7104bbf51108fcb36af226f20d70e25c7c2858a63
SSDEEP

98304:QXWzvaxGO6qYagxr2ivoJ8THtIawpG/c+48RgJ:QWDEaaXJ8THtIawmc+4QgJ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3052	PCMTOSETUP_DEMO.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3052	4960	PCMTOSETUP_DEMO.exe	88
PID 4960 wrote to memory of 3052	4960	PCMTOSETUP_DEMO.exe	88
PID 4960 wrote to memory of 3052	4960	PCMTOSETUP_DEMO.exe	88

C:\Users\Admin\AppData\Local\Temp\PCMTOSETUP_DEMO.exe
"C:\Users\Admin\AppData\Local\Temp\PCMTOSETUP_DEMO.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\is-I48I7.tmp\PCMTOSETUP_DEMO.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-I48I7.tmp\PCMTOSETUP_DEMO.tmp" /SL5="$E0048,3120852,54272,C:\Users\Admin\AppData\Local\Temp\PCMTOSETUP_DEMO.exe"
  2⤵
  - Executes dropped EXE
  PID:3052

C:\Users\Admin\AppData\Local\Temp\is-I48I7.tmp\PCMTOSETUP_DEMO.tmp

Filesize
664KB

MD5
f000769d9fe6c45533dadebda0c8ff1a

SHA1
c4c12c7e4a3aa0bad26a8207ae25459bc1d4cef0

SHA256
e79ab6deb63f4f2958d10f7f4a2ffb00136e9b25ef8d3a0511f538c55a2855e2

SHA512
84ab8cc2d6af329261eda117c51ce792ff09f44ea5ca1d3e0a0287fad35170ac390c76d1dee99ee96952befb2f480ca461b38df6cb07694c528b05860b94e6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I48I7.tmp\PCMTOSETUP_DEMO.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
memory/3052-7-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3052-14-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3052-17-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/4960-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4960-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4960-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download