82f5a693742c6c35f1280dbc5a4148598c129208dfc0544a5cd457b7ac8e824a

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 07:32

Target

Setup_WinThruster_2024.exe
Size

7.3MB
MD5

62f9258f3ae4774f9dc169a2a0b1d68e
SHA1

56164f50722724275c0db381235d3b793f85acd5
SHA256

82f5a693742c6c35f1280dbc5a4148598c129208dfc0544a5cd457b7ac8e824a
SHA512

ef04a48d957d646e0b4fbdb68bfe59bedfb6f5701dd9497b2bc5abeea57b5d7be5f8694ca59d535c8d14514ecacfb6773476abcd3d2f65a1da7c0c75241d7fd2
SSDEEP

98304:cSi3CpUYtyBI5sdXR/YVTWXumt2Q7VJedSNtjrk8rNF3y0HWRR4cmWDjzK45:IClt4I+yTd2rJzrjr7H3r2R2qHb

Score

4^/10

Executes dropped EXE 1 IoCs

Processes:

Setup_WinThruster_2024.tmp

pid process

3680 Setup_WinThruster_2024.tmp

pid	process
3680	Setup_WinThruster_2024.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Setup_WinThruster_2024.exe

description	pid	process	target process
PID 564 wrote to memory of 3680	564	Setup_WinThruster_2024.exe	Setup_WinThruster_2024.tmp
PID 564 wrote to memory of 3680	564	Setup_WinThruster_2024.exe	Setup_WinThruster_2024.tmp
PID 564 wrote to memory of 3680	564	Setup_WinThruster_2024.exe	Setup_WinThruster_2024.tmp

C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:564

C:\Users\Admin\AppData\Local\Temp\is-418L8.tmp\Setup_WinThruster_2024.tmp
"C:\Users\Admin\AppData\Local\Temp\is-418L8.tmp\Setup_WinThruster_2024.tmp" /SL5="$A0064,6737092,878080,C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe"
2⤵
- Executes dropped EXE
PID:3680

C:\Users\Admin\AppData\Local\Temp\is-418L8.tmp\Setup_WinThruster_2024.tmp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/564-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/564-9-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3680-5-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/3680-10-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/3680-13-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download