97ade0db3e1065cef68e24d6d5994d1add725b2e99651217a02d57affffdac7a

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:42

Target

setup_postal_2_5100_(64474).exe
Size

912KB
MD5

679340f557b6752f06a71391de751704
SHA1

1ec115e33571abe957246f6506e5956c39d14dc2
SHA256

97ade0db3e1065cef68e24d6d5994d1add725b2e99651217a02d57affffdac7a
SHA512

b0cac7708c1580e8c6cb28b407986f219ae903477b5d9f9c33d4c3d8bb8c114c2ac17105209f17ce05f6ea04a46ccf9be666d7752a4604509f618e3da3b76825
SSDEEP

24576:Mxct1NCRZljVpYVzu+1Ifl9vXEadlYfm3cG:oigLlct0982lYfm3n

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4564	setup_postal_2_5100_(64474).tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 4564	2704	setup_postal_2_5100_(64474).exe	84
PID 2704 wrote to memory of 4564	2704	setup_postal_2_5100_(64474).exe	84
PID 2704 wrote to memory of 4564	2704	setup_postal_2_5100_(64474).exe	84

C:\Users\Admin\AppData\Local\Temp\setup_postal_2_5100_(64474).exe
"C:\Users\Admin\AppData\Local\Temp\setup_postal_2_5100_(64474).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\is-SAUBE.tmp\setup_postal_2_5100_(64474).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-SAUBE.tmp\setup_postal_2_5100_(64474).tmp" /SL5="$10005A,192512,0,C:\Users\Admin\AppData\Local\Temp\setup_postal_2_5100_(64474).exe"
  2⤵
  - Executes dropped EXE
  PID:4564

C:\Users\Admin\AppData\Local\Temp\is-SAUBE.tmp\setup_postal_2_5100_(64474).tmp

Filesize
1.3MB

MD5
4597d848cfd32900a74b4c5719b97541

SHA1
56cfa6af300c9363084f0595490a0f196d784a19

SHA256
90c22ed45be810fdb5ec962dbe7bf4d41318f376dd7025ffe8e3b8d9c814a403

SHA512
a7f37630e7ed73bba6eaf7ef5965593ba6bd42d8317063472b2e99e22bce20d95e867ee23efdf2a5c66976f550432a4e71e52c0b6e02d243d69f9957b8a35172

Download Submit
memory/2704-0-0x0000000000BC0000-0x0000000000BF9000-memory.dmp

Filesize
228KB

Download
memory/2704-2-0x0000000000BC1000-0x0000000000BD2000-memory.dmp

Filesize
68KB

Download
memory/2704-8-0x0000000000BC0000-0x0000000000BF9000-memory.dmp

Filesize
228KB

Download
memory/4564-6-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/4564-9-0x00000000002C0000-0x0000000000412000-memory.dmp

Filesize
1.3MB

Download
memory/4564-12-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download