a7d09d04e2809b8b99fe0962f5eec197a693bdaa8417104bbe16d54e0dfb52ff

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 12:50

Target

utorrent_installer.exe
Size

1.7MB
MD5

73a64a1762dfaa87c5a0a4b5dda48108
SHA1

053a1719433f9d2c0a1e573ffad4464abc34363a
SHA256

a7d09d04e2809b8b99fe0962f5eec197a693bdaa8417104bbe16d54e0dfb52ff
SHA512

f61ed91e9835aea5fb0941ceafccbf591c592b2401bb55a03e1ed35cfa3a309672141480b8049f06789beee9df9c212e74da64d49c90a6be702f92256fe3e40e
SSDEEP

24576:r7FUDowAyrTVE3U5FbM7i9fshTiAM3k+St17U0TYs6JQ2FGhNXBNZHnUEJ:rBuZrEU3T9Edib3BSdTY7JQ2cDHUEJ

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
4172	utorrent_installer.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4172	4176	utorrent_installer.exe	22
PID 4176 wrote to memory of 4172	4176	utorrent_installer.exe	22
PID 4176 wrote to memory of 4172	4176	utorrent_installer.exe	22

C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe
"C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Users\Admin\AppData\Local\Temp\is-BE8GE.tmp\utorrent_installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BE8GE.tmp\utorrent_installer.tmp" /SL5="$80092,839070,816128,C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
  2⤵
  - Executes dropped EXE
  PID:4172

C:\Users\Admin\AppData\Local\Temp\is-BE8GE.tmp\utorrent_installer.tmp

Filesize
284KB

MD5
548595044e9d8f0a04ee8f7083cd64cb

SHA1
f1fd9a06cc62562ed8057b241380f05165293495

SHA256
b7b0560f65b9ab75862a8c319147ae05b3a3eaacec4325caf0fdb7162b430838

SHA512
e61412d3450626ebfe7503ed7cc1ba16887a706c9265b86bf6c595d5496a838a5f369ea07bdd7095e7ec192ec50c8a52b3d19a6e816ec7bf2c3e5e09ac49a3f2

Download Submit
memory/4172-6-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/4172-12-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/4172-15-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/4176-0-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/4176-2-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/4176-11-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download