246457363396dcea4cc3d19ce2a431897bac948ae1694d3e87cc0ebaf2ea39f5

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 00:54

Target

reshacker_setup.exe
Size

4.1MB
MD5

02eb693dcfb90a696d191badbcf314ce
SHA1

b1d0352c35d7da251e2fa19ecbe8c1e5286f898f
SHA256

246457363396dcea4cc3d19ce2a431897bac948ae1694d3e87cc0ebaf2ea39f5
SHA512

17b6a5f2446459c058bd035df784adad0e58aa7438a56e02fd75c593eb6bae82719b6293de6b1504e1089cade44b5e137771991816d616c08f92eb2c249cc159
SSDEEP

98304:HEagQkFrdGj3mx1Ijxkp3U3aVTISLUHBrIC0:9gQktdGCxmjY3U3aVTnIH4

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3276	reshacker_setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 3276	676	reshacker_setup.exe	85
PID 676 wrote to memory of 3276	676	reshacker_setup.exe	85
PID 676 wrote to memory of 3276	676	reshacker_setup.exe	85

C:\Users\Admin\AppData\Local\Temp\reshacker_setup.exe
"C:\Users\Admin\AppData\Local\Temp\reshacker_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:676
- C:\Users\Admin\AppData\Local\Temp\is-R4BLT.tmp\reshacker_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-R4BLT.tmp\reshacker_setup.tmp" /SL5="$F003C,3504386,870400,C:\Users\Admin\AppData\Local\Temp\reshacker_setup.exe"
  2⤵
  - Executes dropped EXE
  PID:3276

C:\Users\Admin\AppData\Local\Temp\is-R4BLT.tmp\reshacker_setup.tmp

Filesize
2.5MB

MD5
c5cac19a48b63987b767c8ce36a09282

SHA1
899834cb9faa1a04029403085a761c5a2aae0045

SHA256
9aec7890b56a86f175957b7a99fe57ce6234d16995e019d3008a5d599fdf8e28

SHA512
a796cdec441c82353fc160d92af14ade268172b7d232c8f1bcdd5c807b7dce3c4c4cb877b467446b54f058b0bc4219f82ee99df2851d83d121ced2b3674ab1a5

Download Submit
memory/676-0-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/676-2-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/676-8-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3276-6-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/3276-9-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/3276-12-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download