f79f059c85f302fa259132ae73d06f793dc4b4344151e4c27470130fc7a4c479

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 09:51

Target

fl_patch_installer_20_7_2_1852.exe
Size

110.9MB
MD5

362aaee5634605f6b30075ab72ff9e50
SHA1

b1b630a974994e4bb808e40b69f905eed0efe531
SHA256

33d9b96fac6369e24d59a53538d0c4e5c0e256521bc1326c6e8fbe4373ed5aea
SHA512

9c7b632995ade74f2e8bbc6f79aca97c62e1020ec4ffd16ba3534c9d565552f003e70971429ba69a49ebaed6cb0696c9f2981f18982d4ef11f37d83b6c8934da
SSDEEP

3145728:/fdY1eh7/G2Xu2AzoH5WKxJ8aaVKc/rVat+:a1e1GQu3zoJCkWU+

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1416	fl_patch_installer_20_7_2_1852.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 1416	4148	fl_patch_installer_20_7_2_1852.exe	81
PID 4148 wrote to memory of 1416	4148	fl_patch_installer_20_7_2_1852.exe	81
PID 4148 wrote to memory of 1416	4148	fl_patch_installer_20_7_2_1852.exe	81

C:\Users\Admin\AppData\Local\Temp\fl_patch_installer_20_7_2_1852.exe
"C:\Users\Admin\AppData\Local\Temp\fl_patch_installer_20_7_2_1852.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\is-PQE13.tmp\fl_patch_installer_20_7_2_1852.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PQE13.tmp\fl_patch_installer_20_7_2_1852.tmp" /SL5="$501C6,115877352,125440,C:\Users\Admin\AppData\Local\Temp\fl_patch_installer_20_7_2_1852.exe"
  2⤵
  - Executes dropped EXE
  PID:1416

C:\Users\Admin\AppData\Local\Temp\is-PQE13.tmp\fl_patch_installer_20_7_2_1852.tmp

Filesize
1.1MB

MD5
006c402fd22016b5a5a1c2180ca5ccc9

SHA1
dc8dae24ef11181d145c8d9f6f245f3b67a3e1d0

SHA256
5b246db2dfc1a5d000b0662e2a58e1cb9f89fdc87945597ec1e1f2f245fd7898

SHA512
caea20f48421f7918c9ead0316decba60460c74ff878666e0a48ae1e5b2eb41a37b03c1a59bc3aa416990e49cae155e19894461c28c225f4f9b42e184db289b1

Download Submit
memory/1416-6-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1416-9-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/4148-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4148-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/4148-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download