fb83741f29e99b8af74f9e182c3f1eaebeb2f401a5c6886f1c045d406e282c23

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 15:41

Target

Antares Auto-Tune bundle V9 CE.exe
Size

110.0MB
MD5

cda53632778d1ced63a7c0809b71cb86
SHA1

f7d30963a0d45f35cc015f5c5e5ed58276b0e628
SHA256

fb83741f29e99b8af74f9e182c3f1eaebeb2f401a5c6886f1c045d406e282c23
SHA512

8b6cd507fc76d75aa2d96d5546ef1d12f0c25c015bd195cee914d5501ec277b41801f1adb171ba67b164a3e7e68fd3d232ea9f7903cf11443f9a83db0be18b2e
SSDEEP

3145728:8aDfXHRtVR2oE76WDIJZZPlPZrbsAjHMZN1cy:86vHRtVRu7JsnN5ZfsAjsn1H

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1548	Antares Auto-Tune bundle V9 CE.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1548	2512	Antares Auto-Tune bundle V9 CE.exe	91
PID 2512 wrote to memory of 1548	2512	Antares Auto-Tune bundle V9 CE.exe	91
PID 2512 wrote to memory of 1548	2512	Antares Auto-Tune bundle V9 CE.exe	91

C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe
"C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\is-7FEC0.tmp\Antares Auto-Tune bundle V9 CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7FEC0.tmp\Antares Auto-Tune bundle V9 CE.tmp" /SL5="$5017E,114584709,763392,C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe"
  2⤵
  - Executes dropped EXE
  PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2676 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:4184

C:\Users\Admin\AppData\Local\Temp\is-7FEC0.tmp\Antares Auto-Tune bundle V9 CE.tmp

Filesize
2.5MB

MD5
ebbb655a85d61e4adad34d9ade0ea184

SHA1
41d3a5ab6de2cd4c45bd9545906c53ba9eaf345d

SHA256
4cfcbcffe82bc6943890fa818ded2708f46c4f85ec368de00836ac708acdb080

SHA512
a84a4104356c23fa5a618368fa4ba2793435832f3eefb6b243d1513d7ac586002449f127abc6bbb3cf199a930bdd718c6d1ec273738e1d9796d423ddb312eb50

Download Submit
memory/1548-6-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1548-9-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/1548-12-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/2512-0-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/2512-2-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/2512-8-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download