92529dc0e6449eca21688601020455505462819217b8e8d51f6e7b1dd05a69ef

Analysis

max time kernel
85s
max time network
84s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
29-02-2024 08:57

Target

KeePass-2.56-Setup.exe
Size

4.2MB
MD5

86a0d58d2ae89c639d940dbda48308df
SHA1

1280f427d149a8c5ca797a9ea29e711a3fa2b5ef
SHA256

92529dc0e6449eca21688601020455505462819217b8e8d51f6e7b1dd05a69ef
SHA512

9fffac37da58215108392f8532a2691b8e556175c0e5d8227aad8ab6a923cacb0e0eeca11911bef79b8ab340196c4cc4400e76300c73dbc7993a60386b8dab6a
SSDEEP

98304:FkLUpT18sT3OIsoVv/uGRUCyLkVxXBKLeOKIa:GyFOIsO/umyADXBK

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

KeePass-2.56-Setup.tmp

pid process

1960 KeePass-2.56-Setup.tmp

pid	process
1960	KeePass-2.56-Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

KeePass-2.56-Setup.exe

description	pid	process	target process
PID 2844 wrote to memory of 1960	2844	KeePass-2.56-Setup.exe	KeePass-2.56-Setup.tmp
PID 2844 wrote to memory of 1960	2844	KeePass-2.56-Setup.exe	KeePass-2.56-Setup.tmp
PID 2844 wrote to memory of 1960	2844	KeePass-2.56-Setup.exe	KeePass-2.56-Setup.tmp

C:\Users\Admin\AppData\Local\Temp\KeePass-2.56-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\KeePass-2.56-Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844

C:\Users\Admin\AppData\Local\Temp\is-OHT4G.tmp\KeePass-2.56-Setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-OHT4G.tmp\KeePass-2.56-Setup.tmp" /SL5="$60220,3482807,781312,C:\Users\Admin\AppData\Local\Temp\KeePass-2.56-Setup.exe"
2⤵
- Executes dropped EXE
PID:1960

C:\Users\Admin\AppData\Local\Temp\is-OHT4G.tmp\KeePass-2.56-Setup.tmp
Filesize
3.0MB

MD5
354613dd35e43746f934c0e9d7b2543c

SHA1
8b7d3e5306279753e025279455a7d97e1c55cfe4

SHA256
c11513e77b5cd81f07e33111d7a36f5ee4cf551113e30414de753a4c101173d6

SHA512
b3d6a91087a942c5ce04efb179b04989402761b2e634cf1f58924563926d75e034bff675bfb517011c3f91d46d37a5ee69936487830e89270e933c6720d7ef56

Download Submit
memory/1960-6-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/1960-8-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/1960-11-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/1960-20-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2844-1-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2844-7-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download