65ba9774185bd063fdf0060371ade862156df568cf8eabd4876e73dbc5f88823

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/02/2024, 03:30

Target
setup.exe
Size 3.1MB
Sample240226-d2qywsbf53
SHA256 65ba9774185bd063fdf0060371ade862156df568cf8eabd4876e73dbc5f88823
MD5 a4e825daa92e31aefa5c1f745b75a47e
SHA1 6f394a4db78c38646d76fa9721ef22777454fb0f
SHA512 8774351620bd5b6f35ab44aa65418cc8d349563c93991ac89bf4b487aebce385d3787609dcaff1079ba84ed3d0e5772d26dbebf21dbbe2278d4c213464070c87
SSDEEP 49152:ByFuUmoZIDf+ZIo6WUTkWApam3OD3NeIlX/UCJMewVfo7at9nxYBaw45W31aJ:c86q4Io3arSaSVIhvJbiomfCB05o1C
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
1884	setup.tmp

Loads dropped DLL 1 IoCs

pid	Process
1444	setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1884	1444	setup.exe	28
PID 1444 wrote to memory of 1884	1444	setup.exe	28
PID 1444 wrote to memory of 1884	1444	setup.exe	28
PID 1444 wrote to memory of 1884	1444	setup.exe	28
PID 1444 wrote to memory of 1884	1444	setup.exe	28
PID 1444 wrote to memory of 1884	1444	setup.exe	28
PID 1444 wrote to memory of 1884	1444	setup.exe	28

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\is-MVMQN.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MVMQN.tmp\setup.tmp" /SL5="$400F4,2955084,58368,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1884

setup.tmp

Path \Users\Admin\AppData\Local\Temp\is-MVMQN.tmp\setup.tmp
Size 702KB
SHA256 3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
MD5 1afbd25db5c9a90fe05309f7c4fbcf09
SHA1 baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA512 3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
SSDEEP 12288:XqIRz+f+ui8TrPO37fzH4A63RRwDFtuXUZERmhrNh4dT9TaC+IGNbDtQPuFyxyR:aIZg+uiirPO37fzH4A6haDbcUZEbdT9+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1444-1-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1444-11-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1884-8-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/1884-9-0x0000000000400000-0x00000000004BF000-memory.dmp

Download