70065fdbca03a3c7998ca04388679df5d0085be4fcb6567e4dfdeab4cc13b9ca

Analysis

max time kernel
603s
max time network
453s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 08:17

Target

setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).exe
Size

786KB
MD5

4eb10eeb54ba62f117b5844b86cba5ae
SHA1

93685dabde2ad1de4a53a3e2d6e83c5cf96a2ce2
SHA256

70065fdbca03a3c7998ca04388679df5d0085be4fcb6567e4dfdeab4cc13b9ca
SHA512

73bd9b91a2b8543da387cea79013f9cdcb5489b80d65d6adae7a9c66db6544411f2a9f3b089bf108a68152af8f405edc4e862aedc82212951690cd7a99d5fde0
SSDEEP

12288:ujhXLbIvt46NCI888888888888W88888888888Qp7V0DzERXH9nk9alGFsy0WvFn:gxct1NCfh+c19n6/syNpddUorFgtKC6P

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5024	setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 5024	956	setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).exe	89
PID 956 wrote to memory of 5024	956	setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).exe	89
PID 956 wrote to memory of 5024	956	setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).exe	89

C:\Users\Admin\AppData\Local\Temp\setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).exe
"C:\Users\Admin\AppData\Local\Temp\setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\is-F76H7.tmp\setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-F76H7.tmp\setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).tmp" /SL5="$501DE,192512,0,C:\Users\Admin\AppData\Local\Temp\setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).exe"
  2⤵
  - Executes dropped EXE
  PID:5024

C:\Users\Admin\AppData\Local\Temp\is-F76H7.tmp\setup_are_you_smarter_than_a_5th_grader_1.13_shipping_(56293).tmp

Filesize
1.3MB

MD5
9c4cfe244bde67fec1813108331e3083

SHA1
a92648994d1426286b2df7b15d076b3393349f03

SHA256
cc82eddd78108dc20a09e5f56de7e9acbd975d8e5fcf08c61b7842779729a6f4

SHA512
fcea5346705c0684f9092ee37c688f89a6c9fa337b67f7477296ae32635e52185ba2322ceaa2c035783d15b17cd5a9730d05fc137af49bdcad94557a75a70253

Download Submit
memory/956-1-0x00000000005F0000-0x0000000000629000-memory.dmp

Filesize
228KB

Download
memory/956-7-0x00000000005F0000-0x0000000000629000-memory.dmp

Filesize
228KB

Download
memory/5024-6-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download
memory/5024-8-0x0000000000940000-0x0000000000A92000-memory.dmp

Filesize
1.3MB

Download
memory/5024-11-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download