b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d

Analysis

max time kernel
172s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:50

Target

b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe
Size

713KB
MD5

2e5e6c15e8c45c71726de046d4ea74a8
SHA1

1ec1a3c73399d64cadc7a9c0f233ed8cdc26a762
SHA256

b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d
SHA512

ff7bc9af81bcc623aa8cdc3ed7c4029bc32ed3eca0969764971285b8dbb533ae2acb8f3d3588f29742d2dcbe6ef186e9bfab77afd2d2d4c13f48d783f0602d34
SSDEEP

12288:nGMz5TT+i9DRLo4jepFQHtew1g9FnwwTYBLLUGYdQgo+TOPxEoRaKm:GI5n9DuHDAU9FnwR9I5o+TOSooKm

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 852	1584	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe	80
PID 1584 wrote to memory of 852	1584	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe	80
PID 1584 wrote to memory of 852	1584	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe	80

C:\Users\Admin\AppData\Local\Temp\b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe
"C:\Users\Admin\AppData\Local\Temp\b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\system32\mstsc.exe"
  2⤵
  PID:852