a568640bf0d54a20ea8f670d84f755e8e6b0b075782376c42bd3e9288546b3db

Analysis

max time kernel
49s
max time network
18s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Scorch Sound Bank Installer.exe
Size

2.4MB
MD5

897308d054638fa76bde576d301e59ac
SHA1

b693fa5a5786e3321603787eef204e056da0d879
SHA256

a568640bf0d54a20ea8f670d84f755e8e6b0b075782376c42bd3e9288546b3db
SHA512

87eeef1ec1df9e532a6c2a8d6c2cb0cca2db7c7e655efa19601504606c9c45978a226e2a5e2d742fed67a470d5a95f98bf854bb88a0abf25ad816b61055b782e
SSDEEP

49152:Nqe3f6BWR98GUe+DidXvh6dS/04OOR5QvFW:cSiBZGUe+DidXvh6d204OOR5qFW

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2408	Scorch Sound Bank Installer.tmp

Loads dropped DLL 1 IoCs

pid	Process
2540	Scorch Sound Bank Installer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	Scorch Sound Bank Installer.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2408	2540	Scorch Sound Bank Installer.exe	28
PID 2540 wrote to memory of 2408	2540	Scorch Sound Bank Installer.exe	28
PID 2540 wrote to memory of 2408	2540	Scorch Sound Bank Installer.exe	28
PID 2540 wrote to memory of 2408	2540	Scorch Sound Bank Installer.exe	28
PID 2540 wrote to memory of 2408	2540	Scorch Sound Bank Installer.exe	28
PID 2540 wrote to memory of 2408	2540	Scorch Sound Bank Installer.exe	28
PID 2540 wrote to memory of 2408	2540	Scorch Sound Bank Installer.exe	28

C:\Users\Admin\AppData\Local\Temp\Scorch Sound Bank Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Scorch Sound Bank Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\is-V0H8V.tmp\Scorch Sound Bank Installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-V0H8V.tmp\Scorch Sound Bank Installer.tmp" /SL5="$5014E,780800,0,C:\Users\Admin\AppData\Local\Temp\Scorch Sound Bank Installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-V0H8V.tmp\Scorch Sound Bank Installer.tmp

Filesize
2.9MB

MD5
fe7ca639e50c1d122c508245d74339d8

SHA1
fd01d59133e3a9e5fbb8ab7686ae7172bd7554ce

SHA256
3cd771430281c3bbae04fe0b5eee7eafe12c0640b195d0633bbbc166b12cb0f2

SHA512
f3adfd5d9078ed4d384c9a424363536e2bd78c5632d6bc8b23e026b7dd26d11796b769fe5d92b01b7749820368cd16163e2273c7ea8ad7b894044b4608d0074f

Download Submit
\Users\Admin\AppData\Local\Temp\is-V0H8V.tmp\Scorch Sound Bank Installer.tmp

Filesize
267KB

MD5
a16bf1782379e3b183e635bf5792f86c

SHA1
ffc0579df361e845a0ffca9e8735ea234abe1738

SHA256
bdcfdb8310bd92e500dfd4b692b638c33faed5c81f23d9d3c215b51f726776ba

SHA512
01390b9cb291d65458b96215fd683177b30eb3d8218532982c8d6ede8fdcaee34bb980f8355a150189c9dfb6e81e8136cf992f5208ee9b8f7336c35a77e7dce8

Download Submit
memory/2408-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2408-11-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2408-13-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2408-14-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2408-19-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2408-21-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2408-24-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2540-1-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2540-10-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2540-25-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads