a28e6d70e6a17faa0ef6e43d9a776fbba5b5b7daf0980170b63a551207f3d573

Analysis

max time kernel
141s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 12:15

Target

EVDsetup/EVDsetup.exe
Size

1.7MB
MD5

07b414c2329beb9bf041342e3ed7235f
SHA1

82af12c5963cb7f30fac0cdd6719578ed8fb715b
SHA256

4073e1d8d1951e4e10554cabbc5e01e60f3d6f843fe7ceb382bad18927efe521
SHA512

10079a875f8820da8857a14af67dacee99f5597e4df2aa36766111cc24f64e627d134869745deb553920ea1bb096829755db1bfb1cb809fe78a1daa75faf56fc
SSDEEP

24576:L7FUDowAyrTVE3U5FCaJRtkL44IHt9ZXu+ZIJo8x8hkiHNckvwyhaumwE7tUv:LBuZrEUJJR+aHfZaD4oybgx6

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3196	EVDsetup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3196	4676	EVDsetup.exe	83
PID 4676 wrote to memory of 3196	4676	EVDsetup.exe	83
PID 4676 wrote to memory of 3196	4676	EVDsetup.exe	83

C:\Users\Admin\AppData\Local\Temp\EVDsetup\EVDsetup.exe
"C:\Users\Admin\AppData\Local\Temp\EVDsetup\EVDsetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\is-SM3TM.tmp\EVDsetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-SM3TM.tmp\EVDsetup.tmp" /SL5="$9014C,973396,818176,C:\Users\Admin\AppData\Local\Temp\EVDsetup\EVDsetup.exe"
  2⤵
  - Executes dropped EXE
  PID:3196

C:\Users\Admin\AppData\Local\Temp\is-SM3TM.tmp\EVDsetup.tmp

Filesize
3.0MB

MD5
1fa430ad935819abb704d85ebf051c9f

SHA1
cc391b40147ebda2120c59c94bf31e54e6472755

SHA256
24d9767b7f11ceb3cab54bbbee6eed2b5e8a55072dd0b96888d86f367c74ba51

SHA512
5c7fc992459cc6a2db3e8943c745cc01e14571097fcea0303b5eeab5c40df4b03ed5771a3e7ae6b911b47705fcac31034379a5810087c8e86fbbf9bf0f6ef94d

Download Submit
memory/3196-6-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/3196-9-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4676-1-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/4676-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/4676-8-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download