59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35

Analysis

max time kernel
62s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:17

Target

59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe
Size

9.3MB
MD5

25abd21210f1fc420456bd8fa77c432d
SHA1

b0c39c2aebaaad5839d9f3a716a85b609d3c1cea
SHA256

59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35
SHA512

337aeb30de6cbc3526fdf0c0c040c8a14b6718fc7be32e2e2c220db7811b45385dc320a44696ed172e35faa422b653b88a2eae8683395e9087382bf4f046e173
SSDEEP

196608:F2i5US3zVH4w18ut60aknBizd5DgOq7WMet1FH9VPaq:Fb573BH7180NaTDq7WRpL

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe

description	pid	process	target process
PID 2960 wrote to memory of 2732	2960	59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe	pcaui.exe
PID 2960 wrote to memory of 2732	2960	59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe	pcaui.exe

C:\Users\Admin\AppData\Local\Temp\59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe
"C:\Users\Admin\AppData\Local\Temp\59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\system32\pcaui.exe
"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {60fdc094-58fa-41d5-bd57-5c9bd53e8d92} -a "Daemon Tools" -v "DT Soft Ltd." -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 616281 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe"
2⤵
PID:2732

memory/2732-132-0x0000000000000000-mapping.dmp

Download
memory/2960-133-0x0000000000400000-0x0000000000F0F000-memory.dmp

Filesize
11.1MB

Download