359bfe0a22adb85b7db88e117936e156eb7603c77d5786c618944b4384607f27

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 10:18

Target

techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe
Size

525KB
MD5

906800a0a0379b4c61decc34d3cf31a6
SHA1

b8fdc21e2a6e0fedfd03876821eef23d8718b389
SHA256

6e84396ce4bebe8040597e2e9de1f190c192a2429ee474e15cf6d8724822b821
SHA512

052bcf42e61abbb673fb1c70db861fd7df69e7d9fea60e0684f9d9ded28cb5ecdda7f286bae24e8aea16648ba71f56f6cd7b55b48b95b243894e9240af92b8c7
SSDEEP

6144:B2ZrT0+pJrzpYUcGwk1lotp4SjMVkYRmxVtEG3vygPIJP+eh1gOmBfJ75VH/BI0g:B2Z7PqUlusV6EgB+Wiqb660F

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1812	364	techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe	26
PID 364 wrote to memory of 1812	364	techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe	26
PID 364 wrote to memory of 1812	364	techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe	26
PID 364 wrote to memory of 1812	364	techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe	26
PID 364 wrote to memory of 1708	364	techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe	27
PID 364 wrote to memory of 1708	364	techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe	27
PID 364 wrote to memory of 1708	364	techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe	27
PID 364 wrote to memory of 1708	364	techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe	27

C:\Users\Admin\AppData\Local\Temp\techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe
"C:\Users\Admin\AppData\Local\Temp\techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe
  start
  2⤵
  PID:1812
- C:\Users\Admin\AppData\Local\Temp\techsmith_camtasia_studio_8_4_0_1699_repack_tfile_ru.exe
  watch
  2⤵
  PID:1708

memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/364-59-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1708-61-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1708-64-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1812-60-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1812-62-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1812-63-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download