be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:14

Target

be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114.exe
Size

202KB
MD5

ed96c7df46d8a9186ec5815a7b316806
SHA1

6f585c59452f6caa188ba179104aea7b9349c6b7
SHA256

be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114
SHA512

908d2750e4906b37ccdf2089912cf71625f0f7b0dffdb33ed5f0b0ebf0e626f9532890d93a54f97421ed8de5e0e8cc51d816ea7c2f0e468d6757f6f12482090b
SSDEEP

3072:5Tqw2aAW9UXgYsis8uHHHy2/1ajqydT7M6/r13E16uEP9qDNVrTHXI:5T+lsOjqydnM6/rBMzD/

Score

8^/10

Blocklisted process makes network request 11 IoCs

Processes:

msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114.exe

pid	process
1584	be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114.exe
1584	be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114.exe

description	pid	process	target process
PID 1584 wrote to memory of 5100	1584	be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114.exe	msiexec.exe
PID 1584 wrote to memory of 5100	1584	be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114.exe	msiexec.exe
PID 1584 wrote to memory of 5100	1584	be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114.exe
"C:\Users\Admin\AppData\Local\Temp\be3430bb4407e5ac6292e6ed6a1dc02b3b2e7c967c73fa91b9ce4b1237254114.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:5100

memory/5100-132-0x0000000000000000-mapping.dmp

Download
memory/5100-133-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/5100-134-0x0000000000A50000-0x0000000000A85000-memory.dmp

Filesize
212KB

Download
memory/5100-135-0x0000000000A50000-0x0000000000A85000-memory.dmp

Filesize
212KB

Download