5d756bf5d1e9bc8cf3e09ab3d7840fbd4bfb1d0725ec5415ef379917dd091ddb

Analysis

max time kernel
1797s
max time network
1817s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 02:20

Target
Setup/sapphire-ofx-install-2024.51.exe
Size 595.4MB
Sample240530-csdrjaba5z
SHA256 2fabcea823b6edd642e87d694ad96f086e9c3c01d25a2a384cb5dbd87ba66556
MD5 31f0c40585dcc9d2a40f19b5d2207d13
SHA1 1d5d3daa9a747dd6829887f1089049b72ce37ec0
SHA512 ac41f18a484b5dca41cdb7532176bb9aabe6088b8e77348b89c87d44693d0e8efb5f9ce879c346ca05930e90ab3acb7b1d5892b541686ab8032522de13379779
SSDEEP 12582912:LjaWPtly594P0k6z6u/7r52SMNtEF5AK/m/omZG:pPtli93k6zzrkSMNta5uomZG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1936	sapphire-ofx-install-2024.51.tmp

Loads dropped DLL 1 IoCs

pid	Process
3044	sapphire-ofx-install-2024.51.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1936	3044	sapphire-ofx-install-2024.51.exe	28
PID 3044 wrote to memory of 1936	3044	sapphire-ofx-install-2024.51.exe	28
PID 3044 wrote to memory of 1936	3044	sapphire-ofx-install-2024.51.exe	28
PID 3044 wrote to memory of 1936	3044	sapphire-ofx-install-2024.51.exe	28
PID 3044 wrote to memory of 1936	3044	sapphire-ofx-install-2024.51.exe	28
PID 3044 wrote to memory of 1936	3044	sapphire-ofx-install-2024.51.exe	28
PID 3044 wrote to memory of 1936	3044	sapphire-ofx-install-2024.51.exe	28

C:\Users\Admin\AppData\Local\Temp\Setup\sapphire-ofx-install-2024.51.exe
"C:\Users\Admin\AppData\Local\Temp\Setup\sapphire-ofx-install-2024.51.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\is-KQ5TM.tmp\sapphire-ofx-install-2024.51.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KQ5TM.tmp\sapphire-ofx-install-2024.51.tmp" /SL5="$5014E,621707205,931840,C:\Users\Admin\AppData\Local\Temp\Setup\sapphire-ofx-install-2024.51.exe"
  2⤵
  - Executes dropped EXE
  PID:1936

sapphire-ofx-install-2024.51.tmp

Path \Users\Admin\AppData\Local\Temp\is-KQ5TM.tmp\sapphire-ofx-install-2024.51.tmp
Size 3.1MB
SHA256 1d7f52285dcb7c53c58eab0df805e71affe15c24148baf661b7fc9d6b826114d
MD5 9d329a7069220c15436d792da03cc7da
SHA1 2c2d52d59863fed999793d670d149d0cb1f6cb8a
SHA512 4f6d3fe6deccfa4a818731eca1f0fb6f34c0c3a352d9a961c7bf40c9d6d4006356d805418139bbc083acfd2a2e0add13d6d64edace692ac0f124b5a5a12ae8f8
SSDEEP 49152:AWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbb333h:ktLutqgwh4NYxtJpkxhG8333
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1936-8-0x0000000000400000-0x000000000072C000-memory.dmp

Download

memory/1936-12-0x0000000000400000-0x000000000072C000-memory.dmp

Download

memory/3044-0-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/3044-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/3044-11-0x0000000000400000-0x00000000004F1000-memory.dmp

Download