a41c96c81fb1143437959da3958ba834701aff642f41e890d1850a85e2540cba

Analysis

max time kernel
262s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 15:50

Target

Scansys_Setup_x64_V1.0.47.40_20230731.exe
Size

724.1MB
MD5

3d7da3c78823557e9cafc45ff49c36ff
SHA1

4140d5269309f1577b310ab49898e92bbbbab6fc
SHA256

a41c96c81fb1143437959da3958ba834701aff642f41e890d1850a85e2540cba
SHA512

d2c60952343d01ce9f78c392004cf415792e0e48ac87c8a45dd78078b12aefdaf05d3c074a22be459112e318e3b1271d5a72b18bcefc4946e86c8c13c16d776e
SSDEEP

12582912:NiaDw+rkZROkeJKnaKEExbq2NjdKilzAo0xgNdLnOSrs6VYNeAOMPNM4JqufADsh:NC+riR3Hn9EExe2NMQAZxgzKS46Vuekj

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2304	Scansys_Setup_x64_V1.0.47.40_20230731.tmp

Loads dropped DLL 1 IoCs

pid	Process
2976	Scansys_Setup_x64_V1.0.47.40_20230731.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2304	2976	Scansys_Setup_x64_V1.0.47.40_20230731.exe	28
PID 2976 wrote to memory of 2304	2976	Scansys_Setup_x64_V1.0.47.40_20230731.exe	28
PID 2976 wrote to memory of 2304	2976	Scansys_Setup_x64_V1.0.47.40_20230731.exe	28
PID 2976 wrote to memory of 2304	2976	Scansys_Setup_x64_V1.0.47.40_20230731.exe	28
PID 2976 wrote to memory of 2304	2976	Scansys_Setup_x64_V1.0.47.40_20230731.exe	28
PID 2976 wrote to memory of 2304	2976	Scansys_Setup_x64_V1.0.47.40_20230731.exe	28
PID 2976 wrote to memory of 2304	2976	Scansys_Setup_x64_V1.0.47.40_20230731.exe	28

C:\Users\Admin\AppData\Local\Temp\Scansys_Setup_x64_V1.0.47.40_20230731.exe
"C:\Users\Admin\AppData\Local\Temp\Scansys_Setup_x64_V1.0.47.40_20230731.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\is-4VP5N.tmp\Scansys_Setup_x64_V1.0.47.40_20230731.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4VP5N.tmp\Scansys_Setup_x64_V1.0.47.40_20230731.tmp" /SL5="$30146,758221525,57856,C:\Users\Admin\AppData\Local\Temp\Scansys_Setup_x64_V1.0.47.40_20230731.exe"
  2⤵
  - Executes dropped EXE
  PID:2304

\Users\Admin\AppData\Local\Temp\is-4VP5N.tmp\Scansys_Setup_x64_V1.0.47.40_20230731.tmp

Filesize
697KB

MD5
832dab307e54aa08f4b6cdd9b9720361

SHA1
ebd007fb7482040ecf34339e4bf917209c1018df

SHA256
cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

SHA512
358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

Download Submit
memory/2304-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2304-11-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2304-14-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2976-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2976-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2976-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download