0c4950be3e7d765fad2a533a75ee0b4a6541a35220624aadbee3d6ac5434cd36

Analysis

max time kernel
142s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 02:21

Target

fdm_x64_setup.exe
Size

41.2MB
MD5

2dffb2a3f68ce9b506f4aa14ceaf433a
SHA1

5d0008687f2bfecbeca68279cbbfbb9791797e36
SHA256

0c4950be3e7d765fad2a533a75ee0b4a6541a35220624aadbee3d6ac5434cd36
SHA512

6de3cd0c8e67b4bec40d01ee099bbbf450ba8321a23b515cfe50e7ebd64605a920513cb46fd41bce61fcafc246b1b8d27a60c31db56bf182d727cf362c770976
SSDEEP

786432:JmUBy8Nm0t6A4md+ipMJ1sIa/ZpsV29K61cIXhjzpFzrPHyA:9yJb+dyJyI0ZCi1c8hP3zr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
64	fdm_x64_setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 64	4900	fdm_x64_setup.exe	88
PID 4900 wrote to memory of 64	4900	fdm_x64_setup.exe	88
PID 4900 wrote to memory of 64	4900	fdm_x64_setup.exe	88

C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\is-73LFS.tmp\fdm_x64_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-73LFS.tmp\fdm_x64_setup.tmp" /SL5="$9011C,42260626,832512,C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"
  2⤵
  - Executes dropped EXE
  PID:64

C:\Users\Admin\AppData\Local\Temp\is-73LFS.tmp\fdm_x64_setup.tmp

Filesize
2.4MB

MD5
ebf5c7653ce165a10c5bcec68025c96c

SHA1
07b6a0a1fcd14d2220a8a1a34ace698506837337

SHA256
1bb59f5747665cf03e26aa168b3637ef8adb8c104a7a62acd0adf548b5baaa67

SHA512
1218888e71e9e096d70c61377043a31d8a8e3af5e2ac9f6cac0cd2f9303a0ae1e967b389e42771bbe55bdf2b9421bdc99ef007be3ec6f5a322f0a68dc225ae6e

Download Submit
memory/64-6-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/64-8-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4900-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4900-2-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4900-7-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download