2ecafd8cc31c43c6eb82587850cb21e2748f2d88e92d94792689fade5555823e

Analysis

max time kernel
141s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 16:54

Target

PrimoCache/PrimoCache_Srv_Setup_4.3.0.exe
Size

7.0MB
MD5

6eef34fcb55dd0b46686bb4ff4b9af2a
SHA1

b1e36aa97e0e7961a22c36074043776831700ac9
SHA256

72272ad5a44142416f124e206a689c7d92b7fa1cdc6efb2e3388343e75d2a0b2
SHA512

172c2c9abf4528efb0d06d3a4ad304eca4d555cbb171b5847d3ceccba7777964aa9ba4daed05e55b2dffe360a932885c790f3e9586b0049696652ef07fbbdf17
SSDEEP

196608:dxV2Vn+IH0xBSz/i0zaxByF8+IGVC3WnOxdXQ8sXdZ:dxV2Vn+IH0x4zasa5eC3ucC8sT

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1836	PrimoCache_Srv_Setup_4.3.0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1836	5052	PrimoCache_Srv_Setup_4.3.0.exe	82
PID 5052 wrote to memory of 1836	5052	PrimoCache_Srv_Setup_4.3.0.exe	82
PID 5052 wrote to memory of 1836	5052	PrimoCache_Srv_Setup_4.3.0.exe	82

C:\Users\Admin\AppData\Local\Temp\PrimoCache\PrimoCache_Srv_Setup_4.3.0.exe
"C:\Users\Admin\AppData\Local\Temp\PrimoCache\PrimoCache_Srv_Setup_4.3.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\is-3I89I.tmp\PrimoCache_Srv_Setup_4.3.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3I89I.tmp\PrimoCache_Srv_Setup_4.3.0.tmp" /SL5="$40212,6755664,417280,C:\Users\Admin\AppData\Local\Temp\PrimoCache\PrimoCache_Srv_Setup_4.3.0.exe"
  2⤵
  - Executes dropped EXE
  PID:1836

C:\Users\Admin\AppData\Local\Temp\is-3I89I.tmp\PrimoCache_Srv_Setup_4.3.0.tmp

Filesize
1.4MB

MD5
12cce569ff0f4c682ee3308acfe4d818

SHA1
5f9dfc178e4c85fc438381b0ad456ba08b818798

SHA256
9ab962babf1dc1379a289441d1bf8ab2732d4e01e24a74213c4e77b34ac92587

SHA512
e4c3fd712234e085fe3c29e1a7b27bc51351b24b0e6188a88876404b8765f23acfe9a7347468f32f6a417663e1e2ede232abc1fe5d87b2585bd9df1e2c57d7fe

Download Submit
memory/1836-6-0x0000000000400000-0x0000000000576000-memory.dmp

Filesize
1.5MB

Download
memory/1836-9-0x0000000000400000-0x0000000000576000-memory.dmp

Filesize
1.5MB

Download
memory/5052-0-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/5052-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/5052-8-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download