250d2d883cb9f5a05a60be5b74191ca357489686a979cf7832fcb4c5f0522eda

Analysis

max time kernel
1s
max time network
4s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 22:52

Target

BorderlessGaming9.5.6_admin_setup.exe
Size

3.9MB
MD5

026e065f1d1e22bfecea6cb03460e513
SHA1

ec946f15b659258328fc8e83e9f65fd964a47714
SHA256

250d2d883cb9f5a05a60be5b74191ca357489686a979cf7832fcb4c5f0522eda
SHA512

29d8fda89350c26c283eaa2011427d5a5026f83c5cdd77db62f2c203aa6d03f02929ed428b1ce5b7fb95204b051a4b5a9f0dfef6dd427ae45cc4545fec3b14fe
SSDEEP

98304:+56YKaUquBz6FaCaukvYiVjLwsJ9lO0DR3n8J:WKKuVGa1ukvYiFlj8J

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
2148	BorderlessGaming9.5.6_admin_setup.tmp

Loads dropped DLL 1 IoCs

pid	Process
3012	BorderlessGaming9.5.6_admin_setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2148	3012	BorderlessGaming9.5.6_admin_setup.exe	28
PID 3012 wrote to memory of 2148	3012	BorderlessGaming9.5.6_admin_setup.exe	28
PID 3012 wrote to memory of 2148	3012	BorderlessGaming9.5.6_admin_setup.exe	28
PID 3012 wrote to memory of 2148	3012	BorderlessGaming9.5.6_admin_setup.exe	28
PID 3012 wrote to memory of 2148	3012	BorderlessGaming9.5.6_admin_setup.exe	28
PID 3012 wrote to memory of 2148	3012	BorderlessGaming9.5.6_admin_setup.exe	28
PID 3012 wrote to memory of 2148	3012	BorderlessGaming9.5.6_admin_setup.exe	28

C:\Users\Admin\AppData\Local\Temp\BorderlessGaming9.5.6_admin_setup.exe
"C:\Users\Admin\AppData\Local\Temp\BorderlessGaming9.5.6_admin_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\is-72FCN.tmp\BorderlessGaming9.5.6_admin_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-72FCN.tmp\BorderlessGaming9.5.6_admin_setup.tmp" /SL5="$70120,3856765,82432,C:\Users\Admin\AppData\Local\Temp\BorderlessGaming9.5.6_admin_setup.exe"
  2⤵
  - Executes dropped EXE
  PID:2148

\Users\Admin\AppData\Local\Temp\is-72FCN.tmp\BorderlessGaming9.5.6_admin_setup.tmp

Filesize
721KB

MD5
98242be0a249553b9b4f1bdbf14cd9d3

SHA1
72fca546b10fad3cf719c5e008748ded45da1228

SHA256
a166749687ffeb6938a0a24bc431a96f054e080994b3292b07d933f67ab7002a

SHA512
08ec542ddfe1e9defa4fd67e8cefb3929bdec727f81611f98602b9057296d7afb55f845fafff578c30ebc6ab254a8be2aa150b05bd95802cbe6bd37a56e8cfd0

Download Submit
memory/2148-8-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download