d3f8e7201ccb06225fe22fa19f5ab5c781ea34e66e120836066845711fe88f2e

Analysis

max time kernel
142s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 04:18

Target

Soar Installer.exe
Size

76.3MB
MD5

4175b4ca85b0c2a70eec398354ac57e3
SHA1

2db6fb3a6b9cabb29dcdd8a91aca8ef9136fd436
SHA256

d3f8e7201ccb06225fe22fa19f5ab5c781ea34e66e120836066845711fe88f2e
SHA512

7fd55889ed25f4e8e537b157e3ddff61d2d83503b0a55c65df4a2e4d6349c0c408c66a860ba7441f33bc2f3cd1455b747ff176394daed42bba9d2b55e845e18a
SSDEEP

1572864:ypSi+t2/oOyCdG/cfCi8ivkRmqRpeZH5CCUWuEXDQIjHnHeydt4QO:YI2dxUcfCi8+kRJEZH5CCXXbjHHFdSQO

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1252	Soar Installer.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1252	4684	Soar Installer.exe	36
PID 4684 wrote to memory of 1252	4684	Soar Installer.exe	36
PID 4684 wrote to memory of 1252	4684	Soar Installer.exe	36

C:\Users\Admin\AppData\Local\Temp\Soar Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Soar Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Local\Temp\is-MR58A.tmp\Soar Installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MR58A.tmp\Soar Installer.tmp" /SL5="$B0162,79072085,1088512,C:\Users\Admin\AppData\Local\Temp\Soar Installer.exe"
  2⤵
  - Executes dropped EXE
  PID:1252

memory/1252-6-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/1252-9-0x0000000000400000-0x0000000000753000-memory.dmp

Filesize
3.3MB

Download
memory/1252-12-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/4684-0-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/4684-2-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/4684-8-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download