3b5e74774cd364e1843eb858181f1d3b657c562f3a8081b972997f33e36a869d

Analysis

max time kernel
142s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 19:52

Target

SimHubSetup_9.2.12.exe
Size

182.1MB
MD5

86c3226649a51d84f04677b2b989a12d
SHA1

4d792241b15bbac7471a866a5259122f519a29f1
SHA256

ed7488ee51854444834ce8294bc592ca9befe8c4c913fc8a1ebf84b32dd99c41
SHA512

d3988010d869c161764c060c2c226140ee09f93446cc93ff06731d1d044c6cd64c29195f24d8e6caa831175448b31df269704a81bedc47e34beb64b78ad4c87d
SSDEEP

3145728:9+ldCIFc7coM5LwUvdnyY2vkatUIDPCNyyETPNlzs38Y6pLw9v3wHfwALVcJTTTS:9+ldCIFicoqcUvdnCUIGNmTsMY6K9v3q

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1772	SimHubSetup_9.2.12.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 1772	3988	SimHubSetup_9.2.12.exe	87
PID 3988 wrote to memory of 1772	3988	SimHubSetup_9.2.12.exe	87
PID 3988 wrote to memory of 1772	3988	SimHubSetup_9.2.12.exe	87

C:\Users\Admin\AppData\Local\Temp\SimHubSetup_9.2.12.exe
"C:\Users\Admin\AppData\Local\Temp\SimHubSetup_9.2.12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Local\Temp\is-F4F2R.tmp\SimHubSetup_9.2.12.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-F4F2R.tmp\SimHubSetup_9.2.12.tmp" /SL5="$50092,189947315,950784,C:\Users\Admin\AppData\Local\Temp\SimHubSetup_9.2.12.exe"
  2⤵
  - Executes dropped EXE
  PID:1772

C:\Users\Admin\AppData\Local\Temp\is-F4F2R.tmp\SimHubSetup_9.2.12.tmp

Filesize
3.1MB

MD5
133b8ce9c332a293fa76c99395532bc2

SHA1
9f7b607b164f4ebae55cc00d70b2982d633d4a9b

SHA256
b398b5700ffbfc124f28c8001c63510e47308bf777c780fa3940dd639c5f50fb

SHA512
a29d4a6f1bdada70304c8d94acec2337d3567c885544eefd4c837adab79df83f32e04f9360610575e8a7db5b0fdd4f3c4e0a0e2318f12ddf05713fb0bc168bb1

Download Submit
memory/1772-6-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/1772-9-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1772-12-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/3988-0-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/3988-2-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/3988-8-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download