f9690d888fe29cc5317f4004be35145ef5b91686a1512e8a78a18c9f0addd8e2

Analysis

max time kernel
83s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 07:47

Target

f9690d888fe29cc5317f4004be35145ef5b91686a1512e8a78a18c9f0addd8e2.exe
Size

181KB
MD5

466e06e272204a2d0d7c88a2f722efc0
SHA1

34ea7716c0cb76ec7ee82c1d0225f800201ca17b
SHA256

f9690d888fe29cc5317f4004be35145ef5b91686a1512e8a78a18c9f0addd8e2
SHA512

ae453d38677c9af8b54c464cfff05310d890147f247c629026de72b7d60310e53c6b3654b76985cecea8a7ed6959caf4aaa180d3d04c62779a7255ae391f7242
SSDEEP

3072:M2FrO/oJHSrQJZu8SUrXMHs2wnkoaRAyqG4UqoWCjFE5K7XrSb0mbLeeHrXJqfrq:N8oJHfJcXIXMHs1nkoMs9yKIrSAm4bQ

Score

8^/10

Blocklisted process makes network request 3 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4336	f9690d888fe29cc5317f4004be35145ef5b91686a1512e8a78a18c9f0addd8e2.exe
4336	f9690d888fe29cc5317f4004be35145ef5b91686a1512e8a78a18c9f0addd8e2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 5056	4336	f9690d888fe29cc5317f4004be35145ef5b91686a1512e8a78a18c9f0addd8e2.exe	82
PID 4336 wrote to memory of 5056	4336	f9690d888fe29cc5317f4004be35145ef5b91686a1512e8a78a18c9f0addd8e2.exe	82
PID 4336 wrote to memory of 5056	4336	f9690d888fe29cc5317f4004be35145ef5b91686a1512e8a78a18c9f0addd8e2.exe	82

C:\Users\Admin\AppData\Local\Temp\f9690d888fe29cc5317f4004be35145ef5b91686a1512e8a78a18c9f0addd8e2.exe
"C:\Users\Admin\AppData\Local\Temp\f9690d888fe29cc5317f4004be35145ef5b91686a1512e8a78a18c9f0addd8e2.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:5056

memory/5056-133-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/5056-134-0x0000000000790000-0x00000000007C0000-memory.dmp

Filesize
192KB

Download
memory/5056-135-0x0000000000790000-0x00000000007C0000-memory.dmp

Filesize
192KB

Download