708c3a754f66c7ea424f1853f6076fd19434f729efff1c7ca5f68c76648f9ca3

Analysis

max time kernel
142s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2023 14:09

Target

CCDisk (v2021.02.19)/ccdisksetup.exe
Size

4.0MB
MD5

dee9faa70dd7776cb8f21e4de5e908ca
SHA1

1dd6c2d94f55fa7955f61f845741af981021e368
SHA256

acbdef532ec5dfab992396e07b8d4c86597d567d805c8855184e0523c169f1cc
SHA512

ae1222ab83f881527ebcff24870d83632b9c69cf14adfe891b3788b3a4ef2fa09494508902244f8b539c872165f8f6612108ebac6a874266b42fbc72bdc6991d
SSDEEP

98304:C9OYMNeGvmsrRsusL43x/JW/IB5+JiPZ3lgoT:2yeGvmsrKj43xB6I2Ex3n

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1052	ccdisksetup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1052	1948	ccdisksetup.exe	88
PID 1948 wrote to memory of 1052	1948	ccdisksetup.exe	88
PID 1948 wrote to memory of 1052	1948	ccdisksetup.exe	88

C:\Users\Admin\AppData\Local\Temp\CCDisk (v2021.02.19)\ccdisksetup.exe
"C:\Users\Admin\AppData\Local\Temp\CCDisk (v2021.02.19)\ccdisksetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\is-9AFFF.tmp\ccdisksetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9AFFF.tmp\ccdisksetup.tmp" /SL5="$A0030,3962269,58368,C:\Users\Admin\AppData\Local\Temp\CCDisk (v2021.02.19)\ccdisksetup.exe"
  2⤵
  - Executes dropped EXE
  PID:1052

C:\Users\Admin\AppData\Local\Temp\is-9AFFF.tmp\ccdisksetup.tmp

Filesize
709KB

MD5
7bc6ee10dbc76acb9dbc72294cff3553

SHA1
6fde2a3122e9bd69e4b2c532d9ecd8471bafdf95

SHA256
9e26391f9a54ab1098a35ca415efd75117275d2c765c8aa9b3846b2bb8e8a3d1

SHA512
3cdc67ae60d6b88b55b1ca5a062d83fa629f825943064ee2d42477b6ed263f619cb011acc7f599b20088f8bd06b8e8b6a5786671d04bb8df828771a6bf7cfd18

Download Submit
memory/1052-139-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1052-141-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1948-133-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1948-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download