2af2ad1b2239aac88b3e517f94ea927d01da652f926f36dae9b27257c8ffc0e2

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 07:04

Target

HoleeBlurayRipper_setup.exe
Size

11.2MB
MD5

ca30de1a3b32497fecd5fc5040ca9e5f
SHA1

ba05da01e029ef0c3678905abad7944aded55339
SHA256

4f800c021b2738a0eca4567f27e84259ad4c2244784422edb2071d4b6d56e211
SHA512

854db50368773628dbd66670d287998ed840802cf1e25302c99189fd8cf53d687fe25faf9e4239f3422b2a347c43baab39f6c0c9c357ff39675e232d6134a5f1
SSDEEP

196608:LPI1ynBYSKyh6ooG2hPwkpqC2fcWWq+CzNi4+6omhGvT/9/Cms793PwT4aQpPemJ:LP8yrT2G2hIkpqx0WWqXzN909//Ac4aG

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2308	HoleeBlurayRipper_setup.tmp

Loads dropped DLL 3 IoCs

pid	Process
2536	HoleeBlurayRipper_setup.exe
2308	HoleeBlurayRipper_setup.tmp
2308	HoleeBlurayRipper_setup.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2308	HoleeBlurayRipper_setup.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2308	2536	HoleeBlurayRipper_setup.exe	28
PID 2536 wrote to memory of 2308	2536	HoleeBlurayRipper_setup.exe	28
PID 2536 wrote to memory of 2308	2536	HoleeBlurayRipper_setup.exe	28
PID 2536 wrote to memory of 2308	2536	HoleeBlurayRipper_setup.exe	28
PID 2536 wrote to memory of 2308	2536	HoleeBlurayRipper_setup.exe	28
PID 2536 wrote to memory of 2308	2536	HoleeBlurayRipper_setup.exe	28
PID 2536 wrote to memory of 2308	2536	HoleeBlurayRipper_setup.exe	28

\Users\Admin\AppData\Local\Temp\is-R0G3O.tmp\HoleeBlurayRipper_setup.tmp

Filesize
700KB

MD5
7b66398c5ea1b438aacdc14bcf7df244

SHA1
4d81d8d42ef6e41203ff648dd069d85d8bab74f3

SHA256
6ebaeb072418c1f22710f13fb90fe3106059b95b9b7fa25a5d5f6640e9785f7d

SHA512
5d6d0e7ea9916502ec1ffaa1ce63f03d37fa6fc05eab5796df19334eee08d1b17f0ee3b89bb94144d4a490bca87dc14579ab4b1ac76729eb3b8270985747577c

Download Submit
\Users\Admin\AppData\Local\Temp\is-S2I42.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/2308-11-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2308-17-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2536-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2536-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2536-16-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download