6b271a5e93256566ecd3a405dc055adf91bda418ceb6267430d61d5a5f5019b9

Analysis

max time kernel
141s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 03:37

Target

PECorrector_Setup.exe
Size

630KB
MD5

612452de915d5de14f1a29574323977f
SHA1

d4fb0350e6c7e53597cea6e5be7de41749c2125b
SHA256

5e0c48f734e2a9259aeea199558d0e8edf8dc511fd0812367316bd849a516320
SHA512

028fed967fbdc53158d6bba5883be78f76cf8a8e6c41004fc87e421896b4116783e85b55d5fe08077bb35188a4aff22754c6270f4c8a5640c31d171bdc7eb1ad
SSDEEP

12288:UUv3yN/eHRtrD+rlsFV+GlXXLAPXq2Ib7zBoVEf8IPlL:UUvd6lsFVNXcfq2gZoVeZL

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
232	is-51GA7.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 232	4796	PECorrector_Setup.exe	83
PID 4796 wrote to memory of 232	4796	PECorrector_Setup.exe	83
PID 4796 wrote to memory of 232	4796	PECorrector_Setup.exe	83

C:\Users\Admin\AppData\Local\Temp\PECorrector_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\PECorrector_Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\is-664D2.tmp\is-51GA7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-664D2.tmp\is-51GA7.tmp" /SL4 $701C4 C:\Users\Admin\AppData\Local\Temp\PECorrector_Setup.exe 632735 69120
  2⤵
  - Executes dropped EXE
  PID:232

C:\Users\Admin\AppData\Local\Temp\is-664D2.tmp\is-51GA7.tmp

Filesize
568KB

MD5
ab5aa911622c20f072f0b6a4cc2b8619

SHA1
0c7927c74bd4edb8641d01edc17aae9026f5e68d

SHA256
ac33240f11b8bd090a7d77e403c2af067fb6ff592df27a146fde93f830985298

SHA512
c28ae032fa4b013fe4d68890450cf6fcaed7f818af170e586e99ef8fc501621fc5c730c8fa8d1c9449ad97c1f5a388d51978c82e054024005fdaf3fcbae8b8e0

Download Submit
memory/232-8-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/232-12-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4796-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4796-2-0x0000000000401000-0x000000000040D000-memory.dmp

Filesize
48KB

Download
memory/4796-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download