c42a16ad014ea0859a5040dabf0aadfd402267833aeaf8b3d2e6119db8061713

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SoundBoosterSetup.exe
Size 6.7MB
Sample240511-tqlsssfa5x
SHA256 4c00a2f66bb1d2470b17ef277f5f12a90ff2fc86a258cb82bf294835b87d4e02
MD5 99aa185a295411f72303fa9b7a497795
SHA1 04cbab9197165b1648ef6fcbf0d1b60d2e0f7a95
SHA512 91e885c217a4753cbc115ce0f2d8fed11092e7562f2a4ac790ccf973ccde46792af5b42315416f0878bbc5e5c2b107c315881a10c8024d2a9ffd59dbfbc7e90f
SSDEEP 196608:ROn0dc1+6+wfqsXYJyHXDGzETzV4L2amU:Q0i1P+wFIJIDGoTJ4L2ax
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2884	SoundBoosterSetup.tmp

Loads dropped DLL 1 IoCs

pid	Process
3016	SoundBoosterSetup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2884	SoundBoosterSetup.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2884	3016	SoundBoosterSetup.exe	28
PID 3016 wrote to memory of 2884	3016	SoundBoosterSetup.exe	28
PID 3016 wrote to memory of 2884	3016	SoundBoosterSetup.exe	28
PID 3016 wrote to memory of 2884	3016	SoundBoosterSetup.exe	28
PID 3016 wrote to memory of 2884	3016	SoundBoosterSetup.exe	28
PID 3016 wrote to memory of 2884	3016	SoundBoosterSetup.exe	28
PID 3016 wrote to memory of 2884	3016	SoundBoosterSetup.exe	28

C:\Users\Admin\AppData\Local\Temp\SoundBoosterSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SoundBoosterSetup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\is-4UITO.tmp\SoundBoosterSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4UITO.tmp\SoundBoosterSetup.tmp" /SL5="$500F8,6484768,412160,C:\Users\Admin\AppData\Local\Temp\SoundBoosterSetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

SoundBoosterSetup.tmp

Path \Users\Admin\AppData\Local\Temp\is-4UITO.tmp\SoundBoosterSetup.tmp
Size 1.4MB
SHA256 48cc8c44e665cc3a24a1ef0807bcd87bdcc0ad9ff179c8d5c96924eba48888f2
MD5 a5e43ff07bf378503cf45d6ee7778021
SHA1 ef988979192938d07c4dd146fb749ed32c8f5568
SHA512 e039f2834f9ada5bf4e0f6ea0c94c9213c433785b99d31b2c288ea29732672a60d9f213ffb4cf47403bb696e19884f18840f1c00ed3861ea7d0fe0e6028126b5
SSDEEP 24576:9tdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt52ZTx9MjiQ:zqTytRFk6ek12fI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2884-8-0x0000000000400000-0x0000000000574000-memory.dmp

Download

memory/2884-11-0x0000000000400000-0x0000000000574000-memory.dmp

Download

memory/3016-2-0x0000000000401000-0x0000000000412000-memory.dmp

Download

memory/3016-0-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3016-10-0x0000000000400000-0x000000000046F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads