8117d10d00a2ad33a1390978ea3872861c330e087914410a6377b22c4c5b8563

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 13:41

Target

innosetup-6.2.2.exe
Size

4.5MB
MD5

2893b10c36fddb20a38e9b8b9a44d647
SHA1

9ab6a2f797d5efc3c5c3985d48fc63c6a111f643
SHA256

8117d10d00a2ad33a1390978ea3872861c330e087914410a6377b22c4c5b8563
SHA512

496375b1ce9c0d2f8eb3930ebd8366f5c4c938bc1eda47aed415e3f02bd8651a84a770a15f2825bf3c8ed9dbefa355b9eb805dd76bc782f6d8c8096d80443099
SSDEEP

98304:6kLsYMYXKk7jmHED1W+Q6zBcLOYCwOo5mympFVWkj6Z:VsoJ7SHElRcLFEo5yhWkj6Z

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

innosetup-6.2.2.tmp

pid process

4944 innosetup-6.2.2.tmp

pid	process
4944	innosetup-6.2.2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

innosetup-6.2.2.exe

description	pid	process	target process
PID 2412 wrote to memory of 4944	2412	innosetup-6.2.2.exe	innosetup-6.2.2.tmp
PID 2412 wrote to memory of 4944	2412	innosetup-6.2.2.exe	innosetup-6.2.2.tmp
PID 2412 wrote to memory of 4944	2412	innosetup-6.2.2.exe	innosetup-6.2.2.tmp

C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.2.exe
"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Users\Admin\AppData\Local\Temp\is-NHSRJ.tmp\innosetup-6.2.2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-NHSRJ.tmp\innosetup-6.2.2.tmp" /SL5="$C005E,3752627,832512,C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.2.exe"
2⤵
- Executes dropped EXE
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4744

C:\Users\Admin\AppData\Local\Temp\is-NHSRJ.tmp\innosetup-6.2.2.tmp

Filesize
3.1MB

MD5
1a860ade3cf55b75dca48e96e5a7fb65

SHA1
595e3d6255f52792c62e7e3c6e1c17039da1b813

SHA256
7d1aa4fa34882122afe88fab6b14b97ef75f26e41dcfefd606f17444016b46aa

SHA512
ec7a49e257863b3dee39c1352b8fd65d3e4a6e4941f74a2082d92b41971d3f73d1ecc44d9ea64c7ce715117e1a1e4316b3631290425a967b4e3678d1cbd5b409

Download Submit
memory/2412-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2412-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2412-8-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4944-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4944-15-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4944-17-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download