73f34feafe1539c4a0a7ced3c7c6004c7cc3003d3a2e22173b0dc98a83e4c14c

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 05:54

Target

navitel_v7_5_0_202_wince_all_maps_q1-2013.exe
Size

507KB
MD5

e4e617d7cb2a20db451ec616c751f94a
SHA1

a9aa53c511b02b0a63575f98451a188023d70e73
SHA256

28d47c83ad373af459d20982bda7cb17fd5f9f63b1da93dfca0be804f7f57c32
SHA512

c369826b80fdc895576e63e4442a83cab760b45457902b88f86def5c8f1398e5e459a23cab42f7d17dd967ff0bd151bc85750ef84e6eb4d0f4f2e0c19d3d8e63
SSDEEP

6144:nwwvf+/8ZZGzhEADZ1jGmA6EG8SVhRLPlGFl62SyVjJdRjAiwzMSGGBCzIcN5fck:wWm/iZUE8ZEN6EUZcFlNPxgQz4HAoW

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 3616	1016	navitel_v7_5_0_202_wince_all_maps_q1-2013.exe	85
PID 1016 wrote to memory of 3616	1016	navitel_v7_5_0_202_wince_all_maps_q1-2013.exe	85
PID 1016 wrote to memory of 3616	1016	navitel_v7_5_0_202_wince_all_maps_q1-2013.exe	85
PID 1016 wrote to memory of 3152	1016	navitel_v7_5_0_202_wince_all_maps_q1-2013.exe	86
PID 1016 wrote to memory of 3152	1016	navitel_v7_5_0_202_wince_all_maps_q1-2013.exe	86
PID 1016 wrote to memory of 3152	1016	navitel_v7_5_0_202_wince_all_maps_q1-2013.exe	86

C:\Users\Admin\AppData\Local\Temp\navitel_v7_5_0_202_wince_all_maps_q1-2013.exe
"C:\Users\Admin\AppData\Local\Temp\navitel_v7_5_0_202_wince_all_maps_q1-2013.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Temp\navitel_v7_5_0_202_wince_all_maps_q1-2013.exe
  start
  2⤵
  PID:3616
- C:\Users\Admin\AppData\Local\Temp\navitel_v7_5_0_202_wince_all_maps_q1-2013.exe
  watch
  2⤵
  PID:3152

memory/1016-134-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3152-136-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3152-137-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3152-140-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3616-135-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3616-138-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3616-139-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download