5d756bf5d1e9bc8cf3e09ab3d7840fbd4bfb1d0725ec5415ef379917dd091ddb

Analysis

max time kernel
1800s
max time network
1179s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 02:20

Target
Setup/sapphire-ofx-install-2024.51.exe
Size 595.4MB
Sample240530-csdrjaba5z
SHA256 2fabcea823b6edd642e87d694ad96f086e9c3c01d25a2a384cb5dbd87ba66556
MD5 31f0c40585dcc9d2a40f19b5d2207d13
SHA1 1d5d3daa9a747dd6829887f1089049b72ce37ec0
SHA512 ac41f18a484b5dca41cdb7532176bb9aabe6088b8e77348b89c87d44693d0e8efb5f9ce879c346ca05930e90ab3acb7b1d5892b541686ab8032522de13379779
SSDEEP 12582912:LjaWPtly594P0k6z6u/7r52SMNtEF5AK/m/omZG:pPtli93k6zzrkSMNta5uomZG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4328	sapphire-ofx-install-2024.51.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4328	4476	sapphire-ofx-install-2024.51.exe	90
PID 4476 wrote to memory of 4328	4476	sapphire-ofx-install-2024.51.exe	90
PID 4476 wrote to memory of 4328	4476	sapphire-ofx-install-2024.51.exe	90

C:\Users\Admin\AppData\Local\Temp\Setup\sapphire-ofx-install-2024.51.exe
"C:\Users\Admin\AppData\Local\Temp\Setup\sapphire-ofx-install-2024.51.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Local\Temp\is-HOLD2.tmp\sapphire-ofx-install-2024.51.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HOLD2.tmp\sapphire-ofx-install-2024.51.tmp" /SL5="$C01CA,621707205,931840,C:\Users\Admin\AppData\Local\Temp\Setup\sapphire-ofx-install-2024.51.exe"
  2⤵
  - Executes dropped EXE
  PID:4328

sapphire-ofx-install-2024.51.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HOLD2.tmp\sapphire-ofx-install-2024.51.tmp
Size 3.1MB
SHA256 1d7f52285dcb7c53c58eab0df805e71affe15c24148baf661b7fc9d6b826114d
MD5 9d329a7069220c15436d792da03cc7da
SHA1 2c2d52d59863fed999793d670d149d0cb1f6cb8a
SHA512 4f6d3fe6deccfa4a818731eca1f0fb6f34c0c3a352d9a961c7bf40c9d6d4006356d805418139bbc083acfd2a2e0add13d6d64edace692ac0f124b5a5a12ae8f8
SSDEEP 49152:AWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbb333h:ktLutqgwh4NYxtJpkxhG8333
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4328-6-0x0000000000400000-0x000000000072C000-memory.dmp

Download

memory/4328-10-0x0000000000400000-0x000000000072C000-memory.dmp

Download

memory/4476-1-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/4476-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/4476-9-0x0000000000400000-0x00000000004F1000-memory.dmp

Download