bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180

Analysis

max time kernel
104s
max time network
111s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 11:08

Target

bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe
Size

228KB
MD5

06f13daa2746b75fa3d94f055ff133c0
SHA1

fb0ca3351ee032d12208eda20924f7b86da1fb0c
SHA256

bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180
SHA512

26bb867157214548310dac2b792e9fa08b1ad74b66558360048a4d6966a298127040b3752f20ef9aae67724a53fb0206a2d74546e7f30d7ae70d37d38031e73e
SSDEEP

6144:N6RcIvEECQ3T88MjfmC0zvCsGQWhOKKZ7sZOAHP:k62d3T8XTUzvCsGQWhOKKy

Score

8^/10

Blocklisted process makes network request 4 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1772	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe
1772	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 940	1772	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe	28
PID 1772 wrote to memory of 940	1772	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe	28
PID 1772 wrote to memory of 940	1772	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe	28
PID 1772 wrote to memory of 940	1772	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe	28
PID 1772 wrote to memory of 940	1772	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe	28
PID 1772 wrote to memory of 940	1772	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe	28
PID 1772 wrote to memory of 940	1772	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe	28

C:\Users\Admin\AppData\Local\Temp\bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe
"C:\Users\Admin\AppData\Local\Temp\bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:940

memory/940-57-0x0000000000170000-0x0000000000184000-memory.dmp

Filesize
80KB

Download
memory/940-58-0x00000000000D0000-0x000000000010B000-memory.dmp

Filesize
236KB

Download
memory/940-59-0x00000000000D0000-0x000000000010B000-memory.dmp

Filesize
236KB

Download
memory/940-60-0x00000000000D0000-0x000000000010B000-memory.dmp

Filesize
236KB

Download
memory/1772-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download