bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 15:59

Target

setup_installer.exe
Size

1.7MB
MD5

6ec2a541fa04ed26f3ab57062c525df7
SHA1

f282b317e1127a365796abd1946b01abddf28912
SHA256

bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a
SHA512

e44dbf482d4b01b8549b28b8c93ebc53b7f408197a023a2485dd702ed26a65c9667cb96c777c65367dfbff6b0c1eb08cf7e55e7a276281462d60485235eadd73
SSDEEP

24576:wGbopD5a6pYGYamhD5+Pf5tWpd5GMUJx8tY9+2JuSsqSkVQX9rQochzH:dbo95a6iGYr5gfGpd5GMJtYg2HSI4Qo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1548	548	setup_installer.exe	31
PID 548 wrote to memory of 1548	548	setup_installer.exe	31
PID 548 wrote to memory of 1548	548	setup_installer.exe	31

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 548 -s 28
  2⤵
  PID:1548

memory/548-0-0x000000013F450000-0x000000013F605000-memory.dmp

Filesize
1.7MB

Download