9b56449030e3f9059034035f7a5694ac5d9a8ef91589827ef7595fe7cc49bed6

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 14:29

Target
fpsmon-5472.exe
Size 12.9MB
Sample240223-rtxclaba77
SHA256 9b56449030e3f9059034035f7a5694ac5d9a8ef91589827ef7595fe7cc49bed6
MD5 01916df07219e6712cdb832b341dd431
SHA1 a9fe587a09a8fb93deab39ceffb26504ea3a887c
SHA512 10d46776a8bc99ea4395a934fc66e27c008894e912da0f0f5b0119eadc2cf2448aedfe2ca221f475c56fdec0695a99ceb8d4b060ba1b8a8284d9f88df712cdb8
SSDEEP 196608:PopUt1DYtc36l9q/LuOvtKg+pQeUsgKKI278zkYOFxByB2NPXBfNGqGu:guDDd6loLuOvttwQpKV278vOFxBh1nYu
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
4852	fpsmon-5472.tmp

Loads dropped DLL 1 IoCs

pid	Process
4852	fpsmon-5472.tmp

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4852	5060	fpsmon-5472.exe	90
PID 5060 wrote to memory of 4852	5060	fpsmon-5472.exe	90
PID 5060 wrote to memory of 4852	5060	fpsmon-5472.exe	90

C:\Users\Admin\AppData\Local\Temp\fpsmon-5472.exe
"C:\Users\Admin\AppData\Local\Temp\fpsmon-5472.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\is-6L11N.tmp\fpsmon-5472.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6L11N.tmp\fpsmon-5472.tmp" /SL5="$60118,12661231,821248,C:\Users\Admin\AppData\Local\Temp\fpsmon-5472.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

fpsmon-5472.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-6L11N.tmp\fpsmon-5472.tmp
Size 3.0MB
SHA256 b6b9875af91d2d799c00b9a0cb9ab682dffdec9bebc80b1ce2255e927f7c24b4
MD5 c7757fddd2607db06a0810021ee61582
SHA1 2f84d74a6ba831c8e8a5d229f22cca0271370085
SHA512 8ef458be3837cf28fa904e190da4835d2442bbf747ce9b6d167926586eeabfbd626c7f554c1b16664e2096d16c239e0089b25aa9311ecb9c3f68eda31edc57ad
SSDEEP 49152:RWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbZ333oV3:ztLutqgwh4NYxtJpkxhGy333ot
MD5 SHA1 SHA512 SSDEEP

Submit Download

InnoInstallPlugin.dll

Path C:\Users\Admin\AppData\Local\Temp\is-SHCB3.tmp\InnoInstallPlugin.dll
Size 74KB
SHA256 843af9958dc1d44b3e36abc312fb70926960f54b431d198d593ddc5dd51c2e2a
MD5 21fc2f7b34831f497de92fd9f5b54d67
SHA1 2d4bca99b7d60a07d65412a12c5f092b22f503b8
SHA512 b3c551462fa06d199a1f469ba5795e3adf128e13533a0479eea91623bceff93d41b6d43fcb1a72bb02edcb488f34a860537db0ecad9f2f8c38743cb7f659ffbb
SSDEEP 1536:maxiws9KhJxBcpbsdfN5xFiiiiiii9Tj149AwjxI:mInb3cpYH5xFiiiiiii93iO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4852-6-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/4852-13-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/4852-16-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/5060-0-0x0000000000400000-0x00000000004D6000-memory.dmp

Download

memory/5060-2-0x0000000000400000-0x00000000004D6000-memory.dmp

Download

memory/5060-12-0x0000000000400000-0x00000000004D6000-memory.dmp

Download