e97857c4af853dfe09d4ee1b7d22d7791beac12e5a16583992e9495f0e25001c

Analysis

max time kernel
69s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 18:40

Target

e97857c4af853dfe09d4ee1b7d22d7791beac12e5a16583992e9495f0e25001c.exe
Size

4.5MB
MD5

1fa34110cae41478b90a41e70de434c2
SHA1

88131f83c6a7250e27a8ca023354d4de280d8851
SHA256

e97857c4af853dfe09d4ee1b7d22d7791beac12e5a16583992e9495f0e25001c
SHA512

c506a7352f6e1f08c5ad161aa6d41c9a64d76a7066f06f304221189b038a5da18f0af02d1c4726df81627f6251ada4b75a96d6465e3d0c98b1e58868684553d1
SSDEEP

98304:boI026J7zUei2pH7ALeVgrsR36rj2ybd8exrD60FT02KtU+D:bts79fpH7meVR9Kj2QCexutUo

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 5116	4644	e97857c4af853dfe09d4ee1b7d22d7791beac12e5a16583992e9495f0e25001c.exe	82
PID 4644 wrote to memory of 5116	4644	e97857c4af853dfe09d4ee1b7d22d7791beac12e5a16583992e9495f0e25001c.exe	82

C:\Users\Admin\AppData\Local\Temp\e97857c4af853dfe09d4ee1b7d22d7791beac12e5a16583992e9495f0e25001c.exe
"C:\Users\Admin\AppData\Local\Temp\e97857c4af853dfe09d4ee1b7d22d7791beac12e5a16583992e9495f0e25001c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\system32\pcaui.exe
  "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {60fdc094-58fa-41d5-bd57-5c9bd53e8d92} -a "Daemon Tools" -v "DT Soft Ltd." -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 616281 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\e97857c4af853dfe09d4ee1b7d22d7791beac12e5a16583992e9495f0e25001c.exe"
  2⤵
  PID:5116