ca863f95b6370e27ecef671a2e7695f2e455537a58d81961141deeb4ba0ed212

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2023, 17:36

Target

hwmonitor-pro_1.46.exe
Size

1.7MB
MD5

1a7c69f2ae1d9ab529e43e72537a2803
SHA1

3a199da4c9676ff6d806cea94fe83c559ddfc019
SHA256

ca863f95b6370e27ecef671a2e7695f2e455537a58d81961141deeb4ba0ed212
SHA512

c555d08f4a85d9c597c610e180044dfcbac142c9b2342c157c5e136df517d4e4996da04e011c8ce32581634b80321722303361d4d8e022abced0468f644467d3
SSDEEP

49152:uyO54VWdDIbHJVwDoWh1Pu0yWZID/r1a:f648+pVwDHuqZIDr1

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
3008	hwmonitor-pro_1.46.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3008	1964	hwmonitor-pro_1.46.exe	84
PID 1964 wrote to memory of 3008	1964	hwmonitor-pro_1.46.exe	84
PID 1964 wrote to memory of 3008	1964	hwmonitor-pro_1.46.exe	84

C:\Users\Admin\AppData\Local\Temp\hwmonitor-pro_1.46.exe
"C:\Users\Admin\AppData\Local\Temp\hwmonitor-pro_1.46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\is-29J3J.tmp\hwmonitor-pro_1.46.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-29J3J.tmp\hwmonitor-pro_1.46.tmp" /SL5="$8011E,1557723,58368,C:\Users\Admin\AppData\Local\Temp\hwmonitor-pro_1.46.exe"
  2⤵
  - Executes dropped EXE
  PID:3008

C:\Users\Admin\AppData\Local\Temp\is-29J3J.tmp\hwmonitor-pro_1.46.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
memory/1964-133-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1964-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3008-139-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3008-141-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download