3188c28bac4a8983542341b7a99c7fb7660147da54d16662733466fb9bf8bf69

Analysis

max time kernel
52s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 04:15

Target

setup_europa_universalis_iv_1.36.6.0_(71197).exe
Size

3.5MB
MD5

cef3933d09af99fce0a09cf776287595
SHA1

90128ccd1d0bc2ddcff61e7af9e10acfcbde961b
SHA256

3188c28bac4a8983542341b7a99c7fb7660147da54d16662733466fb9bf8bf69
SHA512

9a959e7450adee5af37087ac376b4ddb081c8db4bee01f41913df6ced221e113b4601318666d9bf2df5199dbc38680db5c9967397db80a72487f6e025c0ced6a
SSDEEP

49152:cig3JqsCaiN8th/oVNluQagYiVBSB7dbUOLGp4FinoWWug+Hmjv4gB:dspigh+8bwL6pdNZug+Gjvz

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1036	setup_europa_universalis_iv_1.36.6.0_(71197).tmp

Loads dropped DLL 1 IoCs

pid	Process
2236	setup_europa_universalis_iv_1.36.6.0_(71197).exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1036	2236	setup_europa_universalis_iv_1.36.6.0_(71197).exe	30
PID 2236 wrote to memory of 1036	2236	setup_europa_universalis_iv_1.36.6.0_(71197).exe	30
PID 2236 wrote to memory of 1036	2236	setup_europa_universalis_iv_1.36.6.0_(71197).exe	30
PID 2236 wrote to memory of 1036	2236	setup_europa_universalis_iv_1.36.6.0_(71197).exe	30
PID 2236 wrote to memory of 1036	2236	setup_europa_universalis_iv_1.36.6.0_(71197).exe	30
PID 2236 wrote to memory of 1036	2236	setup_europa_universalis_iv_1.36.6.0_(71197).exe	30
PID 2236 wrote to memory of 1036	2236	setup_europa_universalis_iv_1.36.6.0_(71197).exe	30

C:\Users\Admin\AppData\Local\Temp\setup_europa_universalis_iv_1.36.6.0_(71197).exe
"C:\Users\Admin\AppData\Local\Temp\setup_europa_universalis_iv_1.36.6.0_(71197).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\is-6U34O.tmp\setup_europa_universalis_iv_1.36.6.0_(71197).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6U34O.tmp\setup_europa_universalis_iv_1.36.6.0_(71197).tmp" /SL5="$70122,192512,0,C:\Users\Admin\AppData\Local\Temp\setup_europa_universalis_iv_1.36.6.0_(71197).exe"
  2⤵
  - Executes dropped EXE
  PID:1036

C:\Users\Admin\AppData\Local\Temp\is-6U34O.tmp\setup_europa_universalis_iv_1.36.6.0_(71197).tmp

Filesize
1.3MB

MD5
ff5ebf66cddd9913b729de78eeb638c8

SHA1
ca23d5639d1c516e3defc8f5b267bb5c040238d5

SHA256
abf8d4d522ca94a179d644ec0464474b580ec82441b118b663da3bd879f91d85

SHA512
4fa3a2dc8ad68bfffc0e039171d2da71c3c37eade709d5495e825bb53f576180eafee57e3c1f78d7dcc8d26e26cc24e1e99bb494d9b4a55f74f4145eb6e5a05b

Download Submit
memory/1036-8-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1036-10-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/1036-13-0x0000000000110000-0x0000000000262000-memory.dmp

Filesize
1.3MB

Download
memory/1036-14-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2236-2-0x0000000001101000-0x0000000001112000-memory.dmp

Filesize
68KB

Download
memory/2236-0-0x0000000001100000-0x0000000001139000-memory.dmp

Filesize
228KB

Download
memory/2236-9-0x0000000001100000-0x0000000001139000-memory.dmp

Filesize
228KB

Download