a28e6d70e6a17faa0ef6e43d9a776fbba5b5b7daf0980170b63a551207f3d573

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 12:15

Target

EVDsetup/EVDsetup.exe
Size

1.7MB
MD5

07b414c2329beb9bf041342e3ed7235f
SHA1

82af12c5963cb7f30fac0cdd6719578ed8fb715b
SHA256

4073e1d8d1951e4e10554cabbc5e01e60f3d6f843fe7ceb382bad18927efe521
SHA512

10079a875f8820da8857a14af67dacee99f5597e4df2aa36766111cc24f64e627d134869745deb553920ea1bb096829755db1bfb1cb809fe78a1daa75faf56fc
SSDEEP

24576:L7FUDowAyrTVE3U5FCaJRtkL44IHt9ZXu+ZIJo8x8hkiHNckvwyhaumwE7tUv:LBuZrEUJJR+aHfZaD4oybgx6

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1968	EVDsetup.tmp

Loads dropped DLL 1 IoCs

pid	Process
1256	EVDsetup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	EVDsetup.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1968	1256	EVDsetup.exe	28
PID 1256 wrote to memory of 1968	1256	EVDsetup.exe	28
PID 1256 wrote to memory of 1968	1256	EVDsetup.exe	28
PID 1256 wrote to memory of 1968	1256	EVDsetup.exe	28
PID 1256 wrote to memory of 1968	1256	EVDsetup.exe	28
PID 1256 wrote to memory of 1968	1256	EVDsetup.exe	28
PID 1256 wrote to memory of 1968	1256	EVDsetup.exe	28

\Users\Admin\AppData\Local\Temp\is-B4AIL.tmp\EVDsetup.tmp

Filesize
3.0MB

MD5
1fa430ad935819abb704d85ebf051c9f

SHA1
cc391b40147ebda2120c59c94bf31e54e6472755

SHA256
24d9767b7f11ceb3cab54bbbee6eed2b5e8a55072dd0b96888d86f367c74ba51

SHA512
5c7fc992459cc6a2db3e8943c745cc01e14571097fcea0303b5eeab5c40df4b03ed5771a3e7ae6b911b47705fcac31034379a5810087c8e86fbbf9bf0f6ef94d

Download Submit
memory/1256-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1256-0-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/1256-10-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/1968-8-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/1968-11-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download