833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa

Analysis

max time kernel
73s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15-02-2023 18:38

Target

plants-vs-zombies_vhQfH-1.exe
Size

1.7MB
MD5

99a9fbd5fee72ce51585309390a46717
SHA1

ff39c56312090a909c2c0c82629c552a3b252a98
SHA256

833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa
SHA512

97f9a98fb48c8281818163d3dbe66fa246e1fe6a5a67f15175419992b0ca389cbe086e457177c21ce9c99ff05a1e0b508812cdf30220090a438dd8c94f73c6b7
SSDEEP

24576:R4nXubIQGyxbPV0db26Wmd0l4sv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdO7:Rqe3f61mZSffPMWrQ0ZkA

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

plants-vs-zombies_vhQfH-1.tmp

pid process

4968 plants-vs-zombies_vhQfH-1.tmp

pid	process
4968	plants-vs-zombies_vhQfH-1.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

plants-vs-zombies_vhQfH-1.exe

description	pid	process	target process
PID 3452 wrote to memory of 4968	3452	plants-vs-zombies_vhQfH-1.exe	plants-vs-zombies_vhQfH-1.tmp
PID 3452 wrote to memory of 4968	3452	plants-vs-zombies_vhQfH-1.exe	plants-vs-zombies_vhQfH-1.tmp
PID 3452 wrote to memory of 4968	3452	plants-vs-zombies_vhQfH-1.exe	plants-vs-zombies_vhQfH-1.tmp

C:\Users\Admin\AppData\Local\Temp\plants-vs-zombies_vhQfH-1.exe
"C:\Users\Admin\AppData\Local\Temp\plants-vs-zombies_vhQfH-1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3452

C:\Users\Admin\AppData\Local\Temp\is-2AQ1Q.tmp\plants-vs-zombies_vhQfH-1.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2AQ1Q.tmp\plants-vs-zombies_vhQfH-1.tmp" /SL5="$7008E,831488,831488,C:\Users\Admin\AppData\Local\Temp\plants-vs-zombies_vhQfH-1.exe"
2⤵
- Executes dropped EXE
PID:4968

C:\Users\Admin\AppData\Local\Temp\is-2AQ1Q.tmp\plants-vs-zombies_vhQfH-1.tmp
Filesize
3.0MB

MD5
0c229cd26910820581b5809c62fe5619

SHA1
28c0630385b21f29e3e2bcc34865e5d15726eaa0

SHA256
abfa49a915d2e0a82561ca440365e6a2d59f228533b56a8f78addf000a1081b3

SHA512
b8ff3dc65f7c0e03721572af738ec4886ba895dc70c1a41a3ce8c8abe0946d167cec71913017fd11d5892452db761ea88901a5a09a681ae779dd531edbb83a2a

Download Submit
memory/3452-132-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3452-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3452-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4968-135-0x0000000000000000-mapping.dmp

Download