94d8b6f9aaf668356cc58c264e3644fef37ffea41e8901dcb7b738e3ad5e6a77

Analysis

max time kernel
126s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 03:12

Target

Setup.exe
Size

42KB
MD5

5e4087f62f79c1d88ebc506ce62ba894
SHA1

2e2001b04dbbb66c7c49510963ada5ba12377699
SHA256

fc000a126fe4d75e0e3abf49c9f1acd8d353e212206c581c082478f49d2cef3b
SHA512

80c0f34e4235452c91afbb55209019a32aca6b3d7f4100a9c501281b44e90332fd93ec531b131e3493445e056519322ec7ba2b49081725cdc4f19c994fdef8bb
SSDEEP

768:+7Zw33FNUf6Nhd/fQ1l+0vM0iT9UM2ryzOUKFKcMke+:UZ2FWSNhd/4131iKMqwIr6+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1616	2492	Setup.exe	28
PID 2492 wrote to memory of 1616	2492	Setup.exe	28
PID 2492 wrote to memory of 1616	2492	Setup.exe	28
PID 2492 wrote to memory of 1616	2492	Setup.exe	28
PID 2492 wrote to memory of 1616	2492	Setup.exe	28
PID 2492 wrote to memory of 1616	2492	Setup.exe	28
PID 2492 wrote to memory of 1616	2492	Setup.exe	28

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe
  "C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\activation.jar;lib\antlr4-runtime.jar;lib\asm-all.jar;lib\commons-email.jar;lib\connector-api.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\dyn4j.jar;lib\gson.jar;lib\HikariCP-java6.jar;lib\javassist-GA.jar;lib\jaybird-jdk18.jar;lib\jfoenix.jar;lib\jkeymaster.jar;lib\jna.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-desktop-hotkey-ext.jar;lib\jphp-game-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-gui-jfoenix-ext.jar;lib\jphp-json-ext.jar;lib\jphp-jsoup-ext.jar;lib\jphp-mail-ext.jar;lib\jphp-runtime.jar;lib\jphp-sql-ext.jar;lib\jphp-systemtray-ext.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\jsoup.jar;lib\mail.jar;lib\mysql-connector-java.jar;lib\postgresql.jre7.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\sqlite-jdbc.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
  2⤵
  PID:1616

memory/1616-38-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-44-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-17-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-24-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-33-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-34-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1616-8-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-52-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-49-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-48-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-41-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-50-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/1616-51-0x00000000027C0000-0x00000000047C0000-memory.dmp

Filesize
32.0MB

Download
memory/2492-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download