9966e3ed6693dfc42904a2aaa1b294a2cd1edd059ef795729a76956cc21cd239

Analysis

max time kernel
141s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:52

Target

OpenHashTab_setup.exe
Size

10.3MB
MD5

49356c6f4ece9852430d888542883102
SHA1

11f025d8f43d5411312eed035b09c813d01d7cab
SHA256

9966e3ed6693dfc42904a2aaa1b294a2cd1edd059ef795729a76956cc21cd239
SHA512

52e8fbb83b1f99bbc58b97eeed7bcda0053888e3423e608f3e09762313a6d0bfee78d353ea36048971ccf68086ca1879cfe5000d608b18148686741d9b5bd15c
SSDEEP

196608:NA/XXiLssSWCVCbfgj0UFw/uRPl45Pqp65yT9v3rN7sW58NTL:2/HiMWuCb4gePlSPqp3x3r9cNv

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5000	OpenHashTab_setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 5000	940	OpenHashTab_setup.exe	83
PID 940 wrote to memory of 5000	940	OpenHashTab_setup.exe	83
PID 940 wrote to memory of 5000	940	OpenHashTab_setup.exe	83

C:\Users\Admin\AppData\Local\Temp\OpenHashTab_setup.exe
"C:\Users\Admin\AppData\Local\Temp\OpenHashTab_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Users\Admin\AppData\Local\Temp\is-3PQJM.tmp\OpenHashTab_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3PQJM.tmp\OpenHashTab_setup.tmp" /SL5="$B0058,9830692,832512,C:\Users\Admin\AppData\Local\Temp\OpenHashTab_setup.exe"
  2⤵
  - Executes dropped EXE
  PID:5000

C:\Users\Admin\AppData\Local\Temp\is-3PQJM.tmp\OpenHashTab_setup.tmp

Filesize
3.1MB

MD5
0ad5f016db8d7c911ba2bd2470fa707c

SHA1
f2a546b69086c0e6f58ed101306b260ed6572d41

SHA256
0578254906516cdcf2237fe7793c80643e1793b063f82be214b04c57515c36e2

SHA512
cff8782dbe8891d4b53ef596b0f5b3b8e7455f1d1de3ba0937a979ad5f483f23e324a2d90846a64e0c506eb7bcba2bf9f358f952e00b8d8c2d4a6982d008f389

Download Submit
memory/940-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/940-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/940-7-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5000-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/5000-8-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download