d9aae28f6bc432c800a6fff1c4832ca9f24f7a1f7d4d05fd5b9869e8975ff668

Analysis

max time kernel
103s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 11:56

Target

d9aae28f6bc432c800a6fff1c4832ca9f24f7a1f7d4d05fd5b9869e8975ff668.exe
Size

123KB
MD5

83d30d0dce44d00a979e1fdac965be94
SHA1

719bcbfaa8a763edd4df50fe6ec622051b105764
SHA256

d9aae28f6bc432c800a6fff1c4832ca9f24f7a1f7d4d05fd5b9869e8975ff668
SHA512

ab01344083f6aca3d3829ab87da663046b9ebc46130220b6780115909ef9b5d46f827704d31d0d2dbb4b215b27c421b5acd9f873cc6aae3bae709b48437fba70
SSDEEP

1536:U1yhGzbIKygDC4fCye+cyR/A00JAiAH1Ws5Y+YOft3PTcTlLDJUGlNf1UFj:IyhCbIKyAtZJym9Y+h1rcTzUGjf1

Score

8^/10

Blocklisted process makes network request 4 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2216	d9aae28f6bc432c800a6fff1c4832ca9f24f7a1f7d4d05fd5b9869e8975ff668.exe
2216	d9aae28f6bc432c800a6fff1c4832ca9f24f7a1f7d4d05fd5b9869e8975ff668.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2064	2216	d9aae28f6bc432c800a6fff1c4832ca9f24f7a1f7d4d05fd5b9869e8975ff668.exe	82
PID 2216 wrote to memory of 2064	2216	d9aae28f6bc432c800a6fff1c4832ca9f24f7a1f7d4d05fd5b9869e8975ff668.exe	82
PID 2216 wrote to memory of 2064	2216	d9aae28f6bc432c800a6fff1c4832ca9f24f7a1f7d4d05fd5b9869e8975ff668.exe	82

C:\Users\Admin\AppData\Local\Temp\d9aae28f6bc432c800a6fff1c4832ca9f24f7a1f7d4d05fd5b9869e8975ff668.exe
"C:\Users\Admin\AppData\Local\Temp\d9aae28f6bc432c800a6fff1c4832ca9f24f7a1f7d4d05fd5b9869e8975ff668.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:2064

memory/2064-133-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/2064-134-0x0000000000C80000-0x0000000000CA2000-memory.dmp

Filesize
136KB

Download
memory/2064-135-0x0000000000C80000-0x0000000000CA2000-memory.dmp

Filesize
136KB

Download