968bdbfe007fcfbc669643510a45e133a19d92bf3a27d8e6267758a633c48885

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
10/02/2023, 08:07

Target

CiscoPacketTracer_820_Windows_64bit.exe
Size

223.3MB
MD5

66d5133f95f9ea6aefd1f439fab02be6
SHA1

ddbc262abd68dc5e10170310a5f5cfdf37912c89
SHA256

968bdbfe007fcfbc669643510a45e133a19d92bf3a27d8e6267758a633c48885
SHA512

74491cc79eaa72da0e07fc6ea11adf711f9fd1a52cd84e1796a8797acbefdfb7f0d33ad3dd60311bfea0dc6ff59ab9434e467b8c98ccbff78b52086a69745ff2
SSDEEP

6291456:4wPRmjrOtnZ4Wix4WwqVPgciIPIGI6DAfFu:UjStnZ4Wi7wKwzzu

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
948	CiscoPacketTracer_820_Windows_64bit.tmp

Loads dropped DLL 1 IoCs

pid	Process
1100	CiscoPacketTracer_820_Windows_64bit.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 948	1100	CiscoPacketTracer_820_Windows_64bit.exe	28
PID 1100 wrote to memory of 948	1100	CiscoPacketTracer_820_Windows_64bit.exe	28
PID 1100 wrote to memory of 948	1100	CiscoPacketTracer_820_Windows_64bit.exe	28
PID 1100 wrote to memory of 948	1100	CiscoPacketTracer_820_Windows_64bit.exe	28
PID 1100 wrote to memory of 948	1100	CiscoPacketTracer_820_Windows_64bit.exe	28
PID 1100 wrote to memory of 948	1100	CiscoPacketTracer_820_Windows_64bit.exe	28
PID 1100 wrote to memory of 948	1100	CiscoPacketTracer_820_Windows_64bit.exe	28

C:\Users\Admin\AppData\Local\Temp\CiscoPacketTracer_820_Windows_64bit.exe
"C:\Users\Admin\AppData\Local\Temp\CiscoPacketTracer_820_Windows_64bit.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\is-LLL8R.tmp\CiscoPacketTracer_820_Windows_64bit.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LLL8R.tmp\CiscoPacketTracer_820_Windows_64bit.tmp" /SL5="$8001C,233583460,121344,C:\Users\Admin\AppData\Local\Temp\CiscoPacketTracer_820_Windows_64bit.exe"
  2⤵
  - Executes dropped EXE
  PID:948

C:\Users\Admin\AppData\Local\Temp\is-LLL8R.tmp\CiscoPacketTracer_820_Windows_64bit.tmp

Filesize
1.1MB

MD5
90fc739c83cd19766acb562c66a7d0e2

SHA1
451f385a53d5fed15e7649e7891e05f231ef549a

SHA256
821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431

SHA512
4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c

Download Submit
\Users\Admin\AppData\Local\Temp\is-LLL8R.tmp\CiscoPacketTracer_820_Windows_64bit.tmp

Filesize
1.1MB

MD5
90fc739c83cd19766acb562c66a7d0e2

SHA1
451f385a53d5fed15e7649e7891e05f231ef549a

SHA256
821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431

SHA512
4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c

Download Submit
memory/1100-54-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1100-55-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download