df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771

Analysis

max time kernel
175s
max time network
221s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 12:07

Target

df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe
Size

223KB
MD5

9764029aa2897cecfcca048d87c53243
SHA1

6b8b6524d8233daf7a63408c6abb33b3d6a1dcdf
SHA256

df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771
SHA512

5089533dfe644b70658be1c096d47bb7f6471754be4c64302f021ffc42fd84a4d71e382ea383ea6b51aecd1fbc39bbd8ba9cf40e79f2b1695d5f394d33c413d7
SSDEEP

3072:Aum3EI3hxgpIyxpuoOZ6s3gzoAkPQ2+sjRUfleIu7PXSLT1Z5L0QmZFeDTf4YMnJ:1mdxiPuxx7pYERUKCvl0Q+Fmj4Y8gXe

Score

8^/10

Blocklisted process makes network request 3 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1776	df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe
1776	df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1968	1776	df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe	27
PID 1776 wrote to memory of 1968	1776	df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe	27
PID 1776 wrote to memory of 1968	1776	df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe	27
PID 1776 wrote to memory of 1968	1776	df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe	27
PID 1776 wrote to memory of 1968	1776	df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe	27
PID 1776 wrote to memory of 1968	1776	df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe	27
PID 1776 wrote to memory of 1968	1776	df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe	27

C:\Users\Admin\AppData\Local\Temp\df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe
"C:\Users\Admin\AppData\Local\Temp\df1a45f8e68c500a3db64b2df49f097f1c307177934e3dc2fdf056260a9a4771.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:1968

memory/1776-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x0000000000000000-mapping.dmp

Download
memory/1968-57-0x00000000007E0000-0x00000000007F4000-memory.dmp

Filesize
80KB

Download
memory/1968-58-0x0000000000090000-0x00000000000CA000-memory.dmp

Filesize
232KB

Download
memory/1968-59-0x0000000000090000-0x00000000000CA000-memory.dmp

Filesize
232KB

Download