2d71df1167c44f87a518d77d1487d5b4960ba8e97b75aafcb6ec3a34fb77d418

Analysis

max time kernel
142s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2023 18:05

Target

CrystalDiskInfo9_1_1.exe
Size

5.5MB
MD5

e83262f10f8a81d81e09496cf20c1e6e
SHA1

ed94394796ed32429c9d81e8684a16daa0619045
SHA256

2d71df1167c44f87a518d77d1487d5b4960ba8e97b75aafcb6ec3a34fb77d418
SHA512

7abf0227244fa39fa6ad0eeed22269f6bebdc7eab9e0bc669e1b6cae77a6f97d6b26e4617e990a5f7ba4fb4bb5d743188ef01716b90d9c17554266187ac79e67
SSDEEP

98304:ckLH6I030IO8jndNP95Jdt3WnnmMXRlzqp5NA1rw4qzELBlokW6NaUqKjcW:bJ60IOiP93WmMXRIpTmrPqo86AG

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
3108	CrystalDiskInfo9_1_1.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3108	224	CrystalDiskInfo9_1_1.exe	86
PID 224 wrote to memory of 3108	224	CrystalDiskInfo9_1_1.exe	86
PID 224 wrote to memory of 3108	224	CrystalDiskInfo9_1_1.exe	86

C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo9_1_1.exe
"C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo9_1_1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\is-5DASD.tmp\CrystalDiskInfo9_1_1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5DASD.tmp\CrystalDiskInfo9_1_1.tmp" /SL5="$401B6,4681573,857600,C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo9_1_1.exe"
  2⤵
  - Executes dropped EXE
  PID:3108

C:\Users\Admin\AppData\Local\Temp\is-5DASD.tmp\CrystalDiskInfo9_1_1.tmp

Filesize
3.1MB

MD5
dcc25a5111e81a4a5ac22ba565aaa5ef

SHA1
1003885f60a86e9502705da7f1d183baea1a555c

SHA256
46f2feb0f3417fc4bac94c5e7daf71745cdf0bcfd3245fd095548e57653d087e

SHA512
0d1961b5e462f79439a263969f11735af5b82139279f4a79af8b6fa09d2df1fb4eeb92fc73f9b619d99de5eb6246d6f546c9fdd3c1e23dac99aad3f7f39e8979

Download Submit
memory/224-1-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/224-8-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3108-6-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/3108-9-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/3108-10-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download