9966e3ed6693dfc42904a2aaa1b294a2cd1edd059ef795729a76956cc21cd239

Analysis

max time kernel
141s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:52

Target
OpenHashTab_setup.exe
Size 10.3MB
Sample240609-jqv2csfg9t
SHA256 9966e3ed6693dfc42904a2aaa1b294a2cd1edd059ef795729a76956cc21cd239
MD5 49356c6f4ece9852430d888542883102
SHA1 11f025d8f43d5411312eed035b09c813d01d7cab
SHA512 52e8fbb83b1f99bbc58b97eeed7bcda0053888e3423e608f3e09762313a6d0bfee78d353ea36048971ccf68086ca1879cfe5000d608b18148686741d9b5bd15c
SSDEEP 196608:NA/XXiLssSWCVCbfgj0UFw/uRPl45Pqp65yT9v3rN7sW58NTL:2/HiMWuCb4gePlSPqp3x3r9cNv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5000	OpenHashTab_setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 5000	940	OpenHashTab_setup.exe	83
PID 940 wrote to memory of 5000	940	OpenHashTab_setup.exe	83
PID 940 wrote to memory of 5000	940	OpenHashTab_setup.exe	83

C:\Users\Admin\AppData\Local\Temp\OpenHashTab_setup.exe
"C:\Users\Admin\AppData\Local\Temp\OpenHashTab_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Users\Admin\AppData\Local\Temp\is-3PQJM.tmp\OpenHashTab_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3PQJM.tmp\OpenHashTab_setup.tmp" /SL5="$B0058,9830692,832512,C:\Users\Admin\AppData\Local\Temp\OpenHashTab_setup.exe"
  2⤵
  - Executes dropped EXE
  PID:5000

OpenHashTab_setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3PQJM.tmp\OpenHashTab_setup.tmp
Size 3.1MB
SHA256 0578254906516cdcf2237fe7793c80643e1793b063f82be214b04c57515c36e2
MD5 0ad5f016db8d7c911ba2bd2470fa707c
SHA1 f2a546b69086c0e6f58ed101306b260ed6572d41
SHA512 cff8782dbe8891d4b53ef596b0f5b3b8e7455f1d1de3ba0937a979ad5f483f23e324a2d90846a64e0c506eb7bcba2bf9f358f952e00b8d8c2d4a6982d008f389
SSDEEP 49152:tWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYY:3tLutqgwh4NYxtJpkxhGj333TH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/940-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/940-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/940-7-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/5000-6-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/5000-8-0x0000000000400000-0x000000000071C000-memory.dmp

Download