45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004

Analysis

max time kernel
167s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 23:59

Target

45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe
Size

234KB
MD5

68df38a1b0b7a445d697c08963f04ca6
SHA1

c6800ae73ee2687723cb17d5f606e907ca55761b
SHA256

45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004
SHA512

305914149fc3c703bcfe838ad8fd4528e3152d8c9d5e671b1f3c174298037eae64407059c0c9560e0d0874651b731a5b0a5f197cfd61199bbfb45d1cff3b8683
SSDEEP

6144:JS669sV5HpHhPp0RnoHVlGaGErTfZUr/Ux6mvDlnnVMPk9SoHtjbTV:JS6wsV5HpHhPp0SHCanlUs6mvD5Vik9d

Score

8^/10

Blocklisted process makes network request 10 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2656	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe
2656	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1672	2656	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe	85
PID 2656 wrote to memory of 1672	2656	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe	85
PID 2656 wrote to memory of 1672	2656	45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe	85

C:\Users\Admin\AppData\Local\Temp\45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe
"C:\Users\Admin\AppData\Local\Temp\45f5bf18ea39e69745e629e9f309adf04303f7c299467315178b85fcacb5e004.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:1672

memory/1672-133-0x0000000000610000-0x0000000000622000-memory.dmp

Filesize
72KB

Download
memory/1672-134-0x0000000000470000-0x00000000004AE000-memory.dmp

Filesize
248KB

Download
memory/1672-135-0x0000000000470000-0x00000000004AE000-memory.dmp

Filesize
248KB

Download