ea53f7f944fada950cd7bb154deb078123a357b7bc5e2484851762b3552eb48b

Analysis

max time kernel
1794s
max time network
1800s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 12:50

Target

KeePass-2.57-Setup.exe
Size

4.2MB
MD5

4c1cafc2b3a380208548620a3d53dbba
SHA1

a4c6ae220ecc6b907e56200809edab3bcdc38b30
SHA256

ea53f7f944fada950cd7bb154deb078123a357b7bc5e2484851762b3552eb48b
SHA512

b2a63cff7b7f01c753dac2723e4ca02b2e86e1ed77741f4254b229f3c79e63aa7392fdbb0ad550055b7438c2a05a8536b71ee05b9afb88a72997f8907490d83b
SSDEEP

98304:hkLaasz0D6H/jUdBfhUEKMEoEGfA58ulnYBh+oKLeOKIaE:yaaszr/WrKv7PPoK/

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1296	KeePass-2.57-Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1296	1892	KeePass-2.57-Setup.exe	90
PID 1892 wrote to memory of 1296	1892	KeePass-2.57-Setup.exe	90
PID 1892 wrote to memory of 1296	1892	KeePass-2.57-Setup.exe	90

C:\Users\Admin\AppData\Local\Temp\KeePass-2.57-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\KeePass-2.57-Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\is-IVON4.tmp\KeePass-2.57-Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IVON4.tmp\KeePass-2.57-Setup.tmp" /SL5="$A0054,3483957,781312,C:\Users\Admin\AppData\Local\Temp\KeePass-2.57-Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3740,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:8
1⤵
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4644,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
1⤵
PID:1540

C:\Users\Admin\AppData\Local\Temp\is-IVON4.tmp\KeePass-2.57-Setup.tmp

Filesize
3.0MB

MD5
515a9f60ae3e548bba65c2d6aba98f75

SHA1
6c68ec325522a413e87daac52da8135d5b2a71ca

SHA256
88fa32ce3c8c9fa0781e812dee4f6eca307c5c4a50d6a1aafcbcbce94f0c91c1

SHA512
7f34993c9043d9b808a9652324d1bff90643f1516c50f4e09b85151cf5b3047a3bdb30923ffc0227bfd1b19ff27fba767b88dedd18db97be8c9efa28b0faa7a9

Download Submit
memory/1296-6-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/1296-9-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/1892-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1892-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1892-8-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download