a67d5dd48c2279867a2600e76b51ab45586da46f199f636eec7f0963db4b1da0

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 03:27

Target

cb56ea529726c8399e6f7b8c54ed40e4.exe
Size

3.2MB
MD5

cb56ea529726c8399e6f7b8c54ed40e4
SHA1

fa79565ec772c51eaeced6769299113f32329a1e
SHA256

a67d5dd48c2279867a2600e76b51ab45586da46f199f636eec7f0963db4b1da0
SHA512

8c5f4345e8d3d89e7cda4ac0dcf11e785c96056f12066711b9c7efe0349e26e2bc2f954418515e2498aed275e8dfe7f1c701f651d0d0b6608322c9e3c43e8ac7
SSDEEP

49152:TBuZrEUeziKl5W9pnjJjzfMZF/F/iu1+49UOyanhEFbqUsMuGjsbjU:VkLeh5o5MZF/FX5UEhub8MuGgHU

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
1932	cb56ea529726c8399e6f7b8c54ed40e4.tmp

Loads dropped DLL 2 IoCs

pid	Process
2576	cb56ea529726c8399e6f7b8c54ed40e4.exe
1932	cb56ea529726c8399e6f7b8c54ed40e4.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1932	cb56ea529726c8399e6f7b8c54ed40e4.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1932	2576	cb56ea529726c8399e6f7b8c54ed40e4.exe	28
PID 2576 wrote to memory of 1932	2576	cb56ea529726c8399e6f7b8c54ed40e4.exe	28
PID 2576 wrote to memory of 1932	2576	cb56ea529726c8399e6f7b8c54ed40e4.exe	28
PID 2576 wrote to memory of 1932	2576	cb56ea529726c8399e6f7b8c54ed40e4.exe	28
PID 2576 wrote to memory of 1932	2576	cb56ea529726c8399e6f7b8c54ed40e4.exe	28
PID 2576 wrote to memory of 1932	2576	cb56ea529726c8399e6f7b8c54ed40e4.exe	28
PID 2576 wrote to memory of 1932	2576	cb56ea529726c8399e6f7b8c54ed40e4.exe	28

C:\Users\Admin\AppData\Local\Temp\is-MVPPI.tmp\cb56ea529726c8399e6f7b8c54ed40e4.tmp

Filesize
3.1MB

MD5
13d9e8b03fb386938ba1fc7bec21d4d6

SHA1
5e9ac915547c3b0a792375e175c6021a434cde4d

SHA256
593c77994b3efad2918c778efa28eae41cc3864068f27a87014578c66da5363b

SHA512
72ce5c7b63d18a88c818d0b92e293883a0d40b022cd81e56bbc5f40e1ec18cdbcf8a6fd355ffe0013bc6df1d0ff8f48ee16c21719a728bdfd801a2e35276db56

Download Submit
\Users\Admin\AppData\Local\Temp\is-KQD8Q.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/1932-8-0x0000000000400000-0x000000000072C000-memory.dmp

Filesize
3.2MB

Download
memory/1932-14-0x0000000000400000-0x000000000072C000-memory.dmp

Filesize
3.2MB

Download
memory/2576-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2576-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2576-13-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download