45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004

Analysis

max time kernel
51s
max time network
117s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 23:59

Target

45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe
Size

234KB
MD5

68df38a1b0b7a445d697c08963f04ca6
SHA1

c6800ae73ee2687723cb17d5f606e907ca55761b
SHA256

45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004
SHA512

305914149fc3c703bcfe838ad8fd4528e3152d8c9d5e671b1f3c174298037eae64407059c0c9560e0d0874651b731a5b0a5f197cfd61199bbfb45d1cff3b8683
SSDEEP

6144:JS669sV5HpHhPp0RnoHVlGaGErTfZUr/Ux6mvDlnnVMPk9SoHtjbTV:JS6wsV5HpHhPp0SHCanlUs6mvD5Vik9d

Score

8^/10

Blocklisted process makes network request 3 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
112	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe
112	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 548	112	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe	27
PID 112 wrote to memory of 548	112	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe	27
PID 112 wrote to memory of 548	112	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe	27
PID 112 wrote to memory of 548	112	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe	27
PID 112 wrote to memory of 548	112	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe	27
PID 112 wrote to memory of 548	112	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe	27
PID 112 wrote to memory of 548	112	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe	27

C:\Users\Admin\AppData\Local\Temp\45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe
"C:\Users\Admin\AppData\Local\Temp\45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:548

memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/548-57-0x0000000000150000-0x0000000000164000-memory.dmp

Filesize
80KB

Download
memory/548-58-0x00000000000F0000-0x000000000012E000-memory.dmp

Filesize
248KB

Download
memory/548-59-0x00000000000F0000-0x000000000012E000-memory.dmp

Filesize
248KB

Download