7f73c93a769b51b149066e92ba8d518712c6c78ec1a8984aba156b757d13fcd8

Analysis

max time kernel
91s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
02-07-2024 11:36

Target

Setup.exe
Size

11.2MB
MD5

8cc723573ea25e383dde086292cea276
SHA1

256f4ff972f9851859471f0b9bcf3ef716bea7f0
SHA256

7f73c93a769b51b149066e92ba8d518712c6c78ec1a8984aba156b757d13fcd8
SHA512

19e4d06fa0d476e09e47173ebd08001bcf862b992b147de0b9c4db8f2508036e7adc19ee04ccd46bf6fbbc8077e4d57ee947e811685cf792c1373176f6fd0ac6
SSDEEP

98304:l2TeFKyXsfAtYOMxy3J060mU/ja+X4JEXXav6Fc01:syFOfwYOMxy5F0mULa+X4KXh

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 332 set thread context of 2868 332 Setup.exe BitLockerToGo.exe

description	pid	process	target process
PID 332 set thread context of 2868	332	Setup.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 332 wrote to memory of 2868	332	Setup.exe	BitLockerToGo.exe
PID 332 wrote to memory of 2868	332	Setup.exe	BitLockerToGo.exe
PID 332 wrote to memory of 2868	332	Setup.exe	BitLockerToGo.exe
PID 332 wrote to memory of 2868	332	Setup.exe	BitLockerToGo.exe
PID 332 wrote to memory of 2868	332	Setup.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:2868

memory/332-2-0x00007FF775A80000-0x00007FF77660D000-memory.dmp

Filesize
11.6MB

Download
memory/332-6-0x00007FF775A80000-0x00007FF77660D000-memory.dmp

Filesize
11.6MB

Download
memory/2868-5-0x00000000008A0000-0x00000000008FA000-memory.dmp

Filesize
360KB

Download
memory/2868-8-0x00000000008A0000-0x00000000008FA000-memory.dmp

Filesize
360KB

Download
memory/2868-9-0x00000000008A0000-0x00000000008FA000-memory.dmp

Filesize
360KB

Download
memory/2868-10-0x00000000008A0000-0x00000000008FA000-memory.dmp

Filesize
360KB

Download