a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 23:43

Target

RogueKiller_setup.exe
Size

46.1MB
MD5

f73c7f375dee046fe26f52cb39214eac
SHA1

70216eb745fff95cef74eb9ae2b62572c6aadc3c
SHA256

a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267
SHA512

58cc2918e143891103c3211aacdc6c0eaf323c66488d6a789a19986a7c99f89be3d84756c72efcc007a1ac64771a10d44fa0c810fdef1778a4851a7f3b6fba08
SSDEEP

786432:YpUjx1LGoEbAdS0merPKjhgeRxWs5I0RbPRbeSC4Uu3o7slDfzPIgdjnAdo0/2fx:YpaKoW0CerPcieRPFNBDCN0nQgX0/2fx

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4416	RogueKiller_setup.tmp

Loads dropped DLL 1 IoCs

pid	Process
4416	RogueKiller_setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4416	2072	RogueKiller_setup.exe	93
PID 2072 wrote to memory of 4416	2072	RogueKiller_setup.exe	93
PID 2072 wrote to memory of 4416	2072	RogueKiller_setup.exe	93

C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe
"C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\is-J00HG.tmp\RogueKiller_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-J00HG.tmp\RogueKiller_setup.tmp" /SL5="$20264,47992881,136192,C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4416

C:\Users\Admin\AppData\Local\Temp\is-FKOOM.tmp\roguekillerdll.dll

Filesize
5.0MB

MD5
d138d33e04d9fe932a28ce27f6b2ffdc

SHA1
02fc5c7be8ae2b7893e6191e9683d1fb19eebf12

SHA256
eecec38966cce281a516f8a1f2e25e5a50110d89aff0959c0665a5ddf5606eaf

SHA512
4605e28fc17682e2802842c714feb4b8ca1fb4fbb5306a79cea8822f9b597286dfe6532add7fcde82291908e035e0db149009fbec0d24815f9127a91be6791d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J00HG.tmp\RogueKiller_setup.tmp

Filesize
784KB

MD5
b2887d41753b031e39037f44583765c8

SHA1
18ff5ba679e4747388cc77febc88ee92d7802828

SHA256
e2fcdcf1c447cb0da876eed12d74fe612e31677a9e433ef4ac5fcdbb34dc5a10

SHA512
28202b0e3d9af75e5046b5cccdc2bb0874ae00a3cb2daf7e32a78e342de92add25ef58318411896975949a5b82dbb401d4896deeb4ab6343c123afe38469e3e3

Download Submit
memory/2072-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2072-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2072-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4416-6-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/4416-13-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/4416-16-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download