17aa55ecf81de6679a77acecca97dfac93914f87dad36e1d20012371edc37f04

Analysis

max time kernel
141s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 20:19

Target

enlisted_launcher_1.0.3.127-czkp9u7y4.exe
Size

8.4MB
MD5

afd4e574b5cc9a87d85c91ed96ac2a17
SHA1

acb7e9df587aaa5b0d1c115670a31bf8d568b230
SHA256

17aa55ecf81de6679a77acecca97dfac93914f87dad36e1d20012371edc37f04
SHA512

42c3864aaf2bc6e9661b8e935590a52ecc3af2ad950ea531a84147d784c19f03e386d2ee5d3ce2597b1ba217c1f674d443e7f759472b8b5f03994fb9ec4f9ce9
SSDEEP

196608:wzEEeKA8Ty0M5jjddI4clFiTyXeXwKaALSQbRuXDoN4XJK:wz9Np/CjjddI5/LuABALSQbaDoN48

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
212	enlisted_launcher_1.0.3.127-czkp9u7y4.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 212	2740	enlisted_launcher_1.0.3.127-czkp9u7y4.exe	86
PID 2740 wrote to memory of 212	2740	enlisted_launcher_1.0.3.127-czkp9u7y4.exe	86
PID 2740 wrote to memory of 212	2740	enlisted_launcher_1.0.3.127-czkp9u7y4.exe	86

C:\Users\Admin\AppData\Local\Temp\enlisted_launcher_1.0.3.127-czkp9u7y4.exe
"C:\Users\Admin\AppData\Local\Temp\enlisted_launcher_1.0.3.127-czkp9u7y4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\is-HB053.tmp\enlisted_launcher_1.0.3.127-czkp9u7y4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HB053.tmp\enlisted_launcher_1.0.3.127-czkp9u7y4.tmp" /SL5="$501D2,8136148,235520,C:\Users\Admin\AppData\Local\Temp\enlisted_launcher_1.0.3.127-czkp9u7y4.exe"
  2⤵
  - Executes dropped EXE
  PID:212

C:\Users\Admin\AppData\Local\Temp\is-HB053.tmp\enlisted_launcher_1.0.3.127-czkp9u7y4.tmp

Filesize
1.2MB

MD5
e4a4abbc27d38cb7dcec49e0ec0834f3

SHA1
cc97d90e88bb2a44e93417a0e573b45b91da337a

SHA256
71de1e8162e0fac224cb3240012527a02aad6b066ca7f66b750579936f2650ab

SHA512
34e608a988e813057e1688626911efe14faa27da63a3457a93d431599a35613097b54d0d2b9f1470b866f270acd9c259f9dffcdc8967715baea6d3e5fa984f77

Download Submit
memory/212-7-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/212-10-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/212-13-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2740-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2740-2-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2740-9-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download