0c5e3216f7f6bb80663143f75e816acc2bcc760cb47d3f7569ebcc9bdbdc2281

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 21:01

Target

Battly-Launcher-win-installer (1).exe
Size

87.5MB
MD5

8b85b5fb77be908dd9c778716d04ff7d
SHA1

7084bd7914ebf6b18123cbee618c0c075b906877
SHA256

0c5e3216f7f6bb80663143f75e816acc2bcc760cb47d3f7569ebcc9bdbdc2281
SHA512

3b32e106c8aad91f4a5c828e917fff0598ea27e7c88f232a9b87faf771770ba61ff652abd396c9585566093ebb7c69c3019c27b3793021fc74ea0594a4ae6680
SSDEEP

1572864:Qdc4v6Skl5L+Pe16OIb08t7oQwrCzDrelX+hefmUYL+RcN6kaWEgPM:gc48l5yW16OIbhahrCbelOh+YLB6kg7

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4620	Battly-Launcher-win-installer (1).tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4620	968	Battly-Launcher-win-installer (1).exe	89
PID 968 wrote to memory of 4620	968	Battly-Launcher-win-installer (1).exe	89
PID 968 wrote to memory of 4620	968	Battly-Launcher-win-installer (1).exe	89

C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win-installer (1).exe
"C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win-installer (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Local\Temp\is-FCOBF.tmp\Battly-Launcher-win-installer (1).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FCOBF.tmp\Battly-Launcher-win-installer (1).tmp" /SL5="$30214,90701607,832512,C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win-installer (1).exe"
  2⤵
  - Executes dropped EXE
  PID:4620

C:\Users\Admin\AppData\Local\Temp\is-FCOBF.tmp\Battly-Launcher-win-installer (1).tmp

Filesize
3.1MB

MD5
d7967ad8ffbc60b7255b62dbf6a733cc

SHA1
0a293aa4a177a93879eb40aba7930c1d7be0c0ff

SHA256
145f163d01ffbff37ea6cd7acc5f3384cd3e385a41ed707c3c2c67600b0e2da9

SHA512
e7efecd12b28881bd510897b026b00df759bb9e97896d6904504eeefd18750f96571f62b1e8dc2d19de43dd1d7a333c685d9396b3e5889199a73094e93ec5d69

Download Submit
memory/968-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/968-7-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4620-6-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/4620-8-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download