5a5926abd441927851251eaf6b4d8f6cff21c3ddfcc6b995eeb645425c5892a3

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 10:21

Target

Sapphire Plug-ins 2021.02 for OFX/sapphire-ofx-install-2021.02.exe
Size

267.2MB
MD5

82cf6358ba4ed33a83b3a798515340b9
SHA1

efd8818e8d04ac3820228357d184b17b0c6aab7e
SHA256

76afb39e59d9b877be7fcbb9e7166a0ae4006579beff46ed9efd952eef8b5889
SHA512

5cf122a942052ec54c2f2f4cbbc3a9b4b09445aa3cf1ecc3cbd43318ad8a8a2d11ee58a1e1d1de8a115a3ff43130091d8cbb194a61f6cf1d3da66060b4a98de3
SSDEEP

6291456:X0L0Rv2dot2ZjMmESY2Q40lHltgPAwkvoXbL92:X0LlWEZR5Y5lFgtkvoLL92

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
2008	sapphire-ofx-install-2021.02.tmp

Loads dropped DLL 1 IoCs

pid	Process
2512	sapphire-ofx-install-2021.02.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2008	2512	sapphire-ofx-install-2021.02.exe	28
PID 2512 wrote to memory of 2008	2512	sapphire-ofx-install-2021.02.exe	28
PID 2512 wrote to memory of 2008	2512	sapphire-ofx-install-2021.02.exe	28
PID 2512 wrote to memory of 2008	2512	sapphire-ofx-install-2021.02.exe	28
PID 2512 wrote to memory of 2008	2512	sapphire-ofx-install-2021.02.exe	28
PID 2512 wrote to memory of 2008	2512	sapphire-ofx-install-2021.02.exe	28
PID 2512 wrote to memory of 2008	2512	sapphire-ofx-install-2021.02.exe	28

C:\Users\Admin\AppData\Local\Temp\Sapphire Plug-ins 2021.02 for OFX\sapphire-ofx-install-2021.02.exe
"C:\Users\Admin\AppData\Local\Temp\Sapphire Plug-ins 2021.02 for OFX\sapphire-ofx-install-2021.02.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\is-7LP9Q.tmp\sapphire-ofx-install-2021.02.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7LP9Q.tmp\sapphire-ofx-install-2021.02.tmp" /SL5="$30146,279670901,61952,C:\Users\Admin\AppData\Local\Temp\Sapphire Plug-ins 2021.02 for OFX\sapphire-ofx-install-2021.02.exe"
  2⤵
  - Executes dropped EXE
  PID:2008

\Users\Admin\AppData\Local\Temp\is-7LP9Q.tmp\sapphire-ofx-install-2021.02.tmp

Filesize
701KB

MD5
6fea6308725988aa64e5dcb7ba3ce7a9

SHA1
a4df4e87a40a70611c7feaf5f5cee2447cbd4593

SHA256
5ea873ebfe31e4ad55a94518142c0676ad364f7af9f823b8ba7d190a05665c7d

SHA512
e5e2b1481f2f56e449280694c962ef768943dd4dcec0bec668debb459eaa98572bb7cad3c3a79a4bf21536ae9494e6548e3735f0a6d7afe020f279d2d3a345a3

Download Submit
memory/2008-8-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2008-12-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2512-2-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/2512-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2512-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download