64c83e7033b61e8e811ea5c19d446cd2d2d884736386468e37290db8cf0763a6

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 14:25

Target

Setup.exe
Size

954KB
MD5

4620f1ba5072f37bdedf2650c654595d
SHA1

7f9079445da0b254457917c97945216eab3536ca
SHA256

ff14c25bf61e359668e0eeadb48345737caebf658f04e5b7ab4d4f465d0fd01c
SHA512

842a1935e95be85365b24a560c02b6bb9ec424a89c5e4240c28e2c63864da814dd862c5ed32847c5277570bed2cc1f90e94fe23fb5cd9950dbea4de18584313a
SSDEEP

12288:FAhvfYClxFGLZx2v0fVmWCHwX2CsyICH8DDFYcs0+qoS9TTa5W9DP4rv8Dsnm:Fivcx2vFDHkxsyIbxxRTTa5W9DP2kIm

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
288	Setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 2680	288	Setup.exe	31
PID 288 wrote to memory of 2680	288	Setup.exe	31
PID 288 wrote to memory of 2680	288	Setup.exe	31

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 288 -s 108
  2⤵
  PID:2680