c27724b9397359fb47bc58c099b631617c8e4136677986f0b59548888f5dc729

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:50

Target

WindowController_setup_01.exe
Size

1.4MB
MD5

cbb042c279c90e63becb2aa3dfb9ee07
SHA1

0d6300469924c70141d16054aea0d8048bf1f377
SHA256

d6a4c190874e0f3e25b30acbb750b26b772fd58bd947c729a40b8fd0858dcaa1
SHA512

31e6a4efcef066fc40446ae20adc1df75e6e953bae9238de436af999a654b4200c5e8bdc44ea6b9512e6cc1c4a5b46fae267f40ff33f24d9e82f192d51f828ce
SSDEEP

24576:unvUEZlqA8+B4fmdcN/3Jt6iQaDnY6Uk22+U6nMZf9vR40tt++/q:uvRbBKN/PTQaDflZfRr+

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3284	WindowController_setup_01.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 3284	2028	WindowController_setup_01.exe	84
PID 2028 wrote to memory of 3284	2028	WindowController_setup_01.exe	84
PID 2028 wrote to memory of 3284	2028	WindowController_setup_01.exe	84
PID 3284 wrote to memory of 3036	3284	WindowController_setup_01.tmp	86
PID 3284 wrote to memory of 3036	3284	WindowController_setup_01.tmp	86
PID 3284 wrote to memory of 3036	3284	WindowController_setup_01.tmp	86

C:\Users\Admin\AppData\Local\Temp\WindowController_setup_01.exe
"C:\Users\Admin\AppData\Local\Temp\WindowController_setup_01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\is-AJB8N.tmp\WindowController_setup_01.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-AJB8N.tmp\WindowController_setup_01.tmp" /SL5="$F0044,1174435,54272,C:\Users\Admin\AppData\Local\Temp\WindowController_setup_01.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\del_bat.cmd""
    3⤵
    PID:3036

C:\Users\Admin\AppData\Local\Temp\del_bat.cmd

Filesize
226B

MD5
4b4b8f5b3f7dc83fa8ea016acb289451

SHA1
af123e212413f74ea357587ddd3e3feeedc465df

SHA256
288981c42288ced83c3829000c41a76bde49a3c4877cd3c5ff63bf6d11a8fd30

SHA512
52bf2fc93590314c3213b0f80c3b4605869fe344478fbe02e719890e35166b62ba0d1b91db0e3c1f92e13173f223f2f7e666d563cc2aa3cc88afc35e282c06f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AJB8N.tmp\WindowController_setup_01.tmp

Filesize
692KB

MD5
68d74e27919dc35df846ae023391a38a

SHA1
3f94254fdb0d1fcaf028c71ae2017b82cb01344c

SHA256
65e3bb3d09773ee3bf2cca941de035c59b356911553d232a6f2ecacdd08115a4

SHA512
0c2e1ffd0d5e5b458d38b9f4d49aae25703bd7730f453537836d533829dad380610b31cbd234db39e997090827fa8ce7a52b574ad04b7d7b4ceed58f2ed09a8a

Download Submit
memory/2028-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2028-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2028-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3284-12-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3284-16-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download