92529dc0e6449eca21688601020455505462819217b8e8d51f6e7b1dd05a69ef

Analysis

max time kernel
63s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 13:18

Target

KeePass-2.56-Setup.exe
Size

4.2MB
MD5

86a0d58d2ae89c639d940dbda48308df
SHA1

1280f427d149a8c5ca797a9ea29e711a3fa2b5ef
SHA256

92529dc0e6449eca21688601020455505462819217b8e8d51f6e7b1dd05a69ef
SHA512

9fffac37da58215108392f8532a2691b8e556175c0e5d8227aad8ab6a923cacb0e0eeca11911bef79b8ab340196c4cc4400e76300c73dbc7993a60386b8dab6a
SSDEEP

98304:FkLUpT18sT3OIsoVv/uGRUCyLkVxXBKLeOKIa:GyFOIsO/umyADXBK

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

KeePass-2.56-Setup.tmp

pid process

2544 KeePass-2.56-Setup.tmp

pid	process
2544	KeePass-2.56-Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

KeePass-2.56-Setup.exe

description	pid	process	target process
PID 5092 wrote to memory of 2544	5092	KeePass-2.56-Setup.exe	KeePass-2.56-Setup.tmp
PID 5092 wrote to memory of 2544	5092	KeePass-2.56-Setup.exe	KeePass-2.56-Setup.tmp
PID 5092 wrote to memory of 2544	5092	KeePass-2.56-Setup.exe	KeePass-2.56-Setup.tmp

C:\Users\Admin\AppData\Local\Temp\KeePass-2.56-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\KeePass-2.56-Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5092

C:\Users\Admin\AppData\Local\Temp\is-PF8V3.tmp\KeePass-2.56-Setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-PF8V3.tmp\KeePass-2.56-Setup.tmp" /SL5="$901DC,3482807,781312,C:\Users\Admin\AppData\Local\Temp\KeePass-2.56-Setup.exe"
2⤵
- Executes dropped EXE
PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5164 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\is-PF8V3.tmp\KeePass-2.56-Setup.tmp
Filesize
3.0MB

MD5
354613dd35e43746f934c0e9d7b2543c

SHA1
8b7d3e5306279753e025279455a7d97e1c55cfe4

SHA256
c11513e77b5cd81f07e33111d7a36f5ee4cf551113e30414de753a4c101173d6

SHA512
b3d6a91087a942c5ce04efb179b04989402761b2e634cf1f58924563926d75e034bff675bfb517011c3f91d46d37a5ee69936487830e89270e933c6720d7ef56

Download Submit
memory/2544-6-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2544-9-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2544-13-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/5092-1-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5092-8-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download