6d164c7778617e002f1048bd1749c4f58edcecbc7703189e01d5791873f5f9fe

Analysis

max time kernel
151s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 07:14

Target

SkypeSetup.exe
Size

21.4MB
MD5

2512f4a5a2c71fafedaba97afa7a9b8a
SHA1

bdcb0999d0e0704468e306a6c94a16cfea52f49f
SHA256

6d164c7778617e002f1048bd1749c4f58edcecbc7703189e01d5791873f5f9fe
SHA512

68f6135b18a04d72668473745f113a3c0b50db06b20c7c95f5a1345ec406d971acf7580ab284e6617d4b6721d96b11a33c8ba011879ac2b74a4a27de7e0ef8d4
SSDEEP

393216:GOZBwvruXBQMyj4Nbwu4A15v88cc6Wdj9YNEc4m7BgJKrP6:GLrs6t0NeA388cc6iMDK

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1484	1316	SkypeSetup.exe	28
PID 1316 wrote to memory of 1484	1316	SkypeSetup.exe	28
PID 1316 wrote to memory of 1484	1316	SkypeSetup.exe	28
PID 1316 wrote to memory of 1484	1316	SkypeSetup.exe	28

C:\Users\Admin\AppData\Local\Temp\SkypeSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SkypeSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\System32\pcaui.exe
  "C:\Windows\System32\pcaui.exe" /g {11111111-1111-1111-1111-111111111111} /x {d94f7ff5-1099-4f52-baa6-2b01b79a24f0} /a "Skype" /v "Skype Technologies S.A." /s "Skype has a known compatibility issue with this version of Windows. For an update that is compatible with this version of Windows, contact Skype Technologies S.A.." /b 1 /e "C:\Users\Admin\AppData\Local\Temp\SkypeSetup.exe"
  2⤵
  PID:1484

memory/1316-54-0x0000000000400000-0x0000000001967000-memory.dmp

Filesize
21.4MB

Download