708c3a754f66c7ea424f1853f6076fd19434f729efff1c7ca5f68c76648f9ca3

Analysis

max time kernel
151s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/03/2023, 14:09

Target

CCDisk (v2021.02.19)/ccdisksetup.exe
Size

4.0MB
MD5

dee9faa70dd7776cb8f21e4de5e908ca
SHA1

1dd6c2d94f55fa7955f61f845741af981021e368
SHA256

acbdef532ec5dfab992396e07b8d4c86597d567d805c8855184e0523c169f1cc
SHA512

ae1222ab83f881527ebcff24870d83632b9c69cf14adfe891b3788b3a4ef2fa09494508902244f8b539c872165f8f6612108ebac6a874266b42fbc72bdc6991d
SSDEEP

98304:C9OYMNeGvmsrRsusL43x/JW/IB5+JiPZ3lgoT:2yeGvmsrKj43xB6I2Ex3n

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1904	ccdisksetup.tmp

Loads dropped DLL 1 IoCs

pid	Process
1236	ccdisksetup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1904	ccdisksetup.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1904	1236	ccdisksetup.exe	26
PID 1236 wrote to memory of 1904	1236	ccdisksetup.exe	26
PID 1236 wrote to memory of 1904	1236	ccdisksetup.exe	26
PID 1236 wrote to memory of 1904	1236	ccdisksetup.exe	26
PID 1236 wrote to memory of 1904	1236	ccdisksetup.exe	26
PID 1236 wrote to memory of 1904	1236	ccdisksetup.exe	26
PID 1236 wrote to memory of 1904	1236	ccdisksetup.exe	26

C:\Users\Admin\AppData\Local\Temp\is-5JL2C.tmp\ccdisksetup.tmp

Filesize
709KB

MD5
7bc6ee10dbc76acb9dbc72294cff3553

SHA1
6fde2a3122e9bd69e4b2c532d9ecd8471bafdf95

SHA256
9e26391f9a54ab1098a35ca415efd75117275d2c765c8aa9b3846b2bb8e8a3d1

SHA512
3cdc67ae60d6b88b55b1ca5a062d83fa629f825943064ee2d42477b6ed263f619cb011acc7f599b20088f8bd06b8e8b6a5786671d04bb8df828771a6bf7cfd18

Download Submit
\Users\Admin\AppData\Local\Temp\is-5JL2C.tmp\ccdisksetup.tmp

Filesize
709KB

MD5
7bc6ee10dbc76acb9dbc72294cff3553

SHA1
6fde2a3122e9bd69e4b2c532d9ecd8471bafdf95

SHA256
9e26391f9a54ab1098a35ca415efd75117275d2c765c8aa9b3846b2bb8e8a3d1

SHA512
3cdc67ae60d6b88b55b1ca5a062d83fa629f825943064ee2d42477b6ed263f619cb011acc7f599b20088f8bd06b8e8b6a5786671d04bb8df828771a6bf7cfd18

Download Submit
memory/1236-54-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1236-63-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1904-61-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1904-64-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1904-65-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download