7e93d0ead93a686218b7c671bf099ef42f09f536083bd0b2f0fa6423a39fc19b

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 00:10

Target

RTP100/Setup.exe
Size

571KB
MD5

f3a1050bac829eebf38a553db08c02e1
SHA1

8a6a2a4e825b1b9de88791c03d7404e181fb0241
SHA256

3b178f718655dab3c444857b5e6fd755dc611de72dc229de486b3e06d8548fd2
SHA512

9e52b8e46192f72eb06971ee06bad397304db7714df4fd0b8397e2bd9d23c1aacdb10667ec1dfeb3b03b600875656f2a60e3b8582ccb6e86aefcae4a38a895f7
SSDEEP

12288:Z3Mjhv8888888888888W88888888888H09+kjn3bVNyRvh6QoqJh5+B+98LApiag:dMjhQ09+miWQpJh5n98LAoa58h5j

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3588	Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3588	4500	Setup.exe	90
PID 4500 wrote to memory of 3588	4500	Setup.exe	90
PID 4500 wrote to memory of 3588	4500	Setup.exe	90

C:\Users\Admin\AppData\Local\Temp\RTP100\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\RTP100\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\is-N7IJQ.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N7IJQ.tmp\Setup.tmp" /SL5="$5022C,140800,0,C:\Users\Admin\AppData\Local\Temp\RTP100\Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:3588

C:\Users\Admin\AppData\Local\Temp\is-N7IJQ.tmp\Setup.tmp

Filesize
154KB

MD5
a1b9dcc51ceaa1bc0e4775bc0bd41b90

SHA1
a905c009ca6f63be26efdb9d69194a61fd45f6e9

SHA256
dbdfec18e5f60db9ea34b830a7649d7275e343e0fa52cdf8c8a870b483c1a70a

SHA512
efa3b6219354c179f3eaa5caf473fb32b2f9857cf1e2f2cf92b2899b72cb8c05d97049a25309ca80f12bb696f5529d7ad02656cd4e76c8b781faf909646122f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N7IJQ.tmp\Setup.tmp

Filesize
64KB

MD5
f19e34015ce517f3196b4b8462165cea

SHA1
71f35d67a0f7a212ee3a9ea4c3859a233d020af2

SHA256
401dad0e05efc1d43647c935781574143402724bf6106d5d19baa8ab88190ff8

SHA512
f4af642952a7bb93be842ebd6a6e8f9d90c86a7da10aff025299c421a3257156b98ce47220e2913233e79e45f3cf202445b4f754c2194308801b98f640736261

Download Submit
memory/3588-6-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/3588-12-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3588-15-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/4500-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4500-11-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download