bd242e163bfb4ce8311dec652877643ba9efd0e07db6f027b096627ce7d05bb8

Analysis

max time kernel
86s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 23:13

Target

bd242e163bfb4ce8311dec652877643ba9efd0e07db6f027b096627ce7d05bb8.exe
Size

163KB
MD5

5ae7ae996acf9f1b14b5d7a43371a5c0
SHA1

1e39c7474ec192eba6221cd340278a778747a177
SHA256

bd242e163bfb4ce8311dec652877643ba9efd0e07db6f027b096627ce7d05bb8
SHA512

2d951ba5cb41a90e203157684fb4cd32a0dba43dc52ebf0c57a0ca780dc0480ad14f29276e802572e6109d643b244c5b034e373e17bfd2e6e54030dcf04d5d0d
SSDEEP

3072:5Q+GeLrzWPn/0TikrWZzoInUQA2JLM89bYU5ybN2SGEZNACEfAPu2JMPJ/:qH/IiXEIzP15ybN2STID

Score

8^/10

Blocklisted process makes network request 3 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1080	bd242e163bfb4ce8311dec652877643ba9efd0e07db6f027b096627ce7d05bb8.exe
1080	bd242e163bfb4ce8311dec652877643ba9efd0e07db6f027b096627ce7d05bb8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1236	1080	bd242e163bfb4ce8311dec652877643ba9efd0e07db6f027b096627ce7d05bb8.exe	79
PID 1080 wrote to memory of 1236	1080	bd242e163bfb4ce8311dec652877643ba9efd0e07db6f027b096627ce7d05bb8.exe	79
PID 1080 wrote to memory of 1236	1080	bd242e163bfb4ce8311dec652877643ba9efd0e07db6f027b096627ce7d05bb8.exe	79

C:\Users\Admin\AppData\Local\Temp\bd242e163bfb4ce8311dec652877643ba9efd0e07db6f027b096627ce7d05bb8.exe
"C:\Users\Admin\AppData\Local\Temp\bd242e163bfb4ce8311dec652877643ba9efd0e07db6f027b096627ce7d05bb8.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:1236

memory/1236-132-0x0000000000000000-mapping.dmp

Download
memory/1236-133-0x0000000000C10000-0x0000000000C22000-memory.dmp

Filesize
72KB

Download
memory/1236-134-0x0000000000F70000-0x0000000000F9C000-memory.dmp

Filesize
176KB

Download
memory/1236-135-0x0000000000F70000-0x0000000000F9C000-memory.dmp

Filesize
176KB

Download
memory/1236-136-0x0000000000F70000-0x0000000000F9C000-memory.dmp

Filesize
176KB

Download