bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180

Analysis

max time kernel
169s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 11:08

Target

bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe
Size

228KB
MD5

06f13daa2746b75fa3d94f055ff133c0
SHA1

fb0ca3351ee032d12208eda20924f7b86da1fb0c
SHA256

bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180
SHA512

26bb867157214548310dac2b792e9fa08b1ad74b66558360048a4d6966a298127040b3752f20ef9aae67724a53fb0206a2d74546e7f30d7ae70d37d38031e73e
SSDEEP

6144:N6RcIvEECQ3T88MjfmC0zvCsGQWhOKKZ7sZOAHP:k62d3T8XTUzvCsGQWhOKKy

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
28	2140	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4756	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe
4756	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 2140	4756	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe	82
PID 4756 wrote to memory of 2140	4756	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe	82
PID 4756 wrote to memory of 2140	4756	bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe	82

C:\Users\Admin\AppData\Local\Temp\bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe
"C:\Users\Admin\AppData\Local\Temp\bedfa42f14e7131031af6858eed7318a0c28bf6a0f9d1f7df1fd592f8bf59180.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Blocklisted process makes network request
  PID:2140

memory/2140-133-0x0000000000300000-0x0000000000312000-memory.dmp

Filesize
72KB

Download
memory/2140-134-0x0000000001250000-0x000000000128B000-memory.dmp

Filesize
236KB

Download
memory/2140-135-0x0000000001250000-0x000000000128B000-memory.dmp

Filesize
236KB

Download