878a47414d5209e784a415d507aac864827490f106ed0290802a333d641a7ac4

Analysis

max time kernel
158s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 13:16

Target

drawpile-2.1.20-setup.exe
Size

15.8MB
MD5

e26f405d32db4698c688893e35b54883
SHA1

5fbb215923a2a4631d10e14eedcaafddb1840c70
SHA256

878a47414d5209e784a415d507aac864827490f106ed0290802a333d641a7ac4
SHA512

0ce6bafb8bef8ef3f6580ddee91b0b645b57fa4cf1cc4620c56b7578968aecdc062d01a82b68f2e22cac1f72579cd4bda27cc3954c24f54365d079dba36b771b
SSDEEP

393216:Xv49iYZyoxeQSOXrR5dQeN1BCk1SJtPLdeHMWSme85CSeYZl1DQGIqH:/HY0oxeZONAJtFzjSdtEGH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1992	drawpile-2.1.20-setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1992	2256	drawpile-2.1.20-setup.exe	90
PID 2256 wrote to memory of 1992	2256	drawpile-2.1.20-setup.exe	90
PID 2256 wrote to memory of 1992	2256	drawpile-2.1.20-setup.exe	90

C:\Users\Admin\AppData\Local\Temp\drawpile-2.1.20-setup.exe
"C:\Users\Admin\AppData\Local\Temp\drawpile-2.1.20-setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\is-INKIT.tmp\drawpile-2.1.20-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-INKIT.tmp\drawpile-2.1.20-setup.tmp" /SL5="$B0050,16341776,57856,C:\Users\Admin\AppData\Local\Temp\drawpile-2.1.20-setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1992

C:\Users\Admin\AppData\Local\Temp\is-INKIT.tmp\drawpile-2.1.20-setup.tmp

Filesize
697KB

MD5
832dab307e54aa08f4b6cdd9b9720361

SHA1
ebd007fb7482040ecf34339e4bf917209c1018df

SHA256
cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

SHA512
358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

Download Submit
memory/1992-6-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/1992-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1992-12-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2256-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2256-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2256-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download