2d35b59fa8da5c6c24f91025a363e96782e59644896712d18b0aa2343bf3008e

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 11:08

Target

2d35b59fa8da5c6c24f91025a363e96782e59644896712d18b0aa2343bf3008e.exe
Size

209KB
MD5

13328a831e0508139e2a53a2c227d430
SHA1

75ef9ea07e3f4cc620c9f2f1a0cf56d5de27833d
SHA256

2d35b59fa8da5c6c24f91025a363e96782e59644896712d18b0aa2343bf3008e
SHA512

40b676e9e2657890a7cc21b4da16f0814209adda6536ad99ddf7ae028971db155d12ae0c3578c8036359c2d2f8e68475fa28cd53eed34d4ce3b9cf5573307232
SSDEEP

6144:C37GeuVs03Xpwiw+tI7NjN57fDL1r4BbYDyNG1:gGjs03XpwqtiNzr5UBbY31

Score

8^/10

Blocklisted process makes network request 3 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4844	2d35b59fa8da5c6c24f91025a363e96782e59644896712d18b0aa2343bf3008e.exe
4844	2d35b59fa8da5c6c24f91025a363e96782e59644896712d18b0aa2343bf3008e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4736	4844	2d35b59fa8da5c6c24f91025a363e96782e59644896712d18b0aa2343bf3008e.exe	80
PID 4844 wrote to memory of 4736	4844	2d35b59fa8da5c6c24f91025a363e96782e59644896712d18b0aa2343bf3008e.exe	80
PID 4844 wrote to memory of 4736	4844	2d35b59fa8da5c6c24f91025a363e96782e59644896712d18b0aa2343bf3008e.exe	80

C:\Users\Admin\AppData\Local\Temp\2d35b59fa8da5c6c24f91025a363e96782e59644896712d18b0aa2343bf3008e.exe
"C:\Users\Admin\AppData\Local\Temp\2d35b59fa8da5c6c24f91025a363e96782e59644896712d18b0aa2343bf3008e.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:4736

memory/4736-133-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/4736-134-0x00000000010A0000-0x00000000010D7000-memory.dmp

Filesize
220KB

Download
memory/4736-135-0x00000000010A0000-0x00000000010D7000-memory.dmp

Filesize
220KB

Download