3103875440dccbe002819f86f46ad8a49d739758dcd524ca104722150ac200ec

Analysis

max time kernel
213s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 05:56

Target

3103875440dccbe002819f86f46ad8a49d739758dcd524ca104722150ac200ec.exe
Size

237KB
MD5

102c0dfed7cf4b12676d02334adbba30
SHA1

e06ddf94ee1d390aab2f9d44182af19bac86ba45
SHA256

3103875440dccbe002819f86f46ad8a49d739758dcd524ca104722150ac200ec
SHA512

3c92a1f58eb1b3525e54b1989b49a645179205adfa709d20e8f72c22ea1249bef709862af25ebca55d07a516035bb11b89b167812ff4616f10b6d68f1ddd0a81
SSDEEP

6144:OW6tPkc0i5VUvdWer8YcapiwA6Nnrnt9jJn:OW6GuUtRli/+rnt9jJ

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
52	4276	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4628	3103875440dccbe002819f86f46ad8a49d739758dcd524ca104722150ac200ec.exe
4628	3103875440dccbe002819f86f46ad8a49d739758dcd524ca104722150ac200ec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4276	4628	3103875440dccbe002819f86f46ad8a49d739758dcd524ca104722150ac200ec.exe	80
PID 4628 wrote to memory of 4276	4628	3103875440dccbe002819f86f46ad8a49d739758dcd524ca104722150ac200ec.exe	80
PID 4628 wrote to memory of 4276	4628	3103875440dccbe002819f86f46ad8a49d739758dcd524ca104722150ac200ec.exe	80

C:\Users\Admin\AppData\Local\Temp\3103875440dccbe002819f86f46ad8a49d739758dcd524ca104722150ac200ec.exe
"C:\Users\Admin\AppData\Local\Temp\3103875440dccbe002819f86f46ad8a49d739758dcd524ca104722150ac200ec.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:4276

memory/4276-133-0x0000000000740000-0x0000000000752000-memory.dmp

Filesize
72KB

Download
memory/4276-134-0x0000000000D50000-0x0000000000D8F000-memory.dmp

Filesize
252KB

Download
memory/4276-135-0x0000000000D50000-0x0000000000D8F000-memory.dmp

Filesize
252KB

Download
memory/4276-136-0x0000000000D50000-0x0000000000D8F000-memory.dmp

Filesize
252KB

Download