d51b7294cc83f1b78ed24992fa74fe20599427fbf65fb20a01b85a3acb31bc40

Analysis

max time kernel
1191s
max time network
839s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 16:25

Target

OhSoft OCam 520.0 Multilingual [PeskTop.com]/oCam_v520.0.exe
Size

9.0MB
MD5

dafaa1c179061339bbf77c479e2deba7
SHA1

6f753b3da62450e5e19e67e3992ffeeb784b017b
SHA256

507b0b3a008cb04c5a56cb373316bf4b0a4a21e6df187d048ef3d2cf3adb26ee
SHA512

1efe4353ffc7156c750cdc05c5f112f68021031b52d5dfe407f2bb70045089b69bc29c318a289f1264fb751f6d35cdf26e6856d56b5cabd158b85f0c01423c9c
SSDEEP

196608:z+NOLLzqBCmhHs2ZScpZJNzWdxNPqYWSQDSWREjzOvZPqtjJbcTkE/41s:iGLeBRxs2DZJNadxNSvSDj0ZPqrbukw1

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
3028	oCam_v520.0.tmp

Loads dropped DLL 1 IoCs

pid	Process
2860	oCam_v520.0.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 3028	2860	oCam_v520.0.exe	28
PID 2860 wrote to memory of 3028	2860	oCam_v520.0.exe	28
PID 2860 wrote to memory of 3028	2860	oCam_v520.0.exe	28
PID 2860 wrote to memory of 3028	2860	oCam_v520.0.exe	28
PID 2860 wrote to memory of 3028	2860	oCam_v520.0.exe	28
PID 2860 wrote to memory of 3028	2860	oCam_v520.0.exe	28
PID 2860 wrote to memory of 3028	2860	oCam_v520.0.exe	28

C:\Users\Admin\AppData\Local\Temp\OhSoft OCam 520.0 Multilingual [PeskTop.com]\oCam_v520.0.exe
"C:\Users\Admin\AppData\Local\Temp\OhSoft OCam 520.0 Multilingual [PeskTop.com]\oCam_v520.0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\is-D0I2A.tmp\oCam_v520.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D0I2A.tmp\oCam_v520.0.tmp" /SL5="$5014E,8795204,243712,C:\Users\Admin\AppData\Local\Temp\OhSoft OCam 520.0 Multilingual [PeskTop.com]\oCam_v520.0.exe"
  2⤵
  - Executes dropped EXE
  PID:3028

C:\Users\Admin\AppData\Local\Temp\is-D0I2A.tmp\oCam_v520.0.tmp

Filesize
856KB

MD5
a012290af00d6cd2742b0875a7be04d4

SHA1
7c53e449b12abadd8cabf25be249032897d266a6

SHA256
9095272066773f271961434fd08b947ba6b046a8cbc4b7357176151a8c4c6101

SHA512
f63dac92c08d2075be1292b411e03a6aa24f6df7bc4ec6317f5b93f9cf812628eb3e6f0b6b5308b0135d70c352b34d1cd4524b049b2d949f27a5275d97e950ec

Download Submit
\Users\Admin\AppData\Local\Temp\is-D0I2A.tmp\oCam_v520.0.tmp

Filesize
1.2MB

MD5
ebd5ac9cc220b0ed542a0efe39b46f6c

SHA1
5cd154b103e3784b2dabad3accb48b19e98a0da0

SHA256
c789e22b9ac96c9a51221d82dffcde951aef27402763460003c2ed97add83c63

SHA512
5b9500d83138d1302fca7d1ba7b2d815870233e515add09c1a252a46b6fdfb80cc794b735dce0896bd800582cb4ab70590e6edf99899854a43c0d6a52b9049b1

Download Submit
memory/2860-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2860-10-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3028-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3028-11-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/3028-14-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download