d51b7294cc83f1b78ed24992fa74fe20599427fbf65fb20a01b85a3acb31bc40

Analysis

max time kernel
1190s
max time network
875s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
14/01/2024, 16:25

Target

OhSoft OCam 520.0 Multilingual [PeskTop.com]/oCam_v520.0.exe
Size

9.0MB
MD5

dafaa1c179061339bbf77c479e2deba7
SHA1

6f753b3da62450e5e19e67e3992ffeeb784b017b
SHA256

507b0b3a008cb04c5a56cb373316bf4b0a4a21e6df187d048ef3d2cf3adb26ee
SHA512

1efe4353ffc7156c750cdc05c5f112f68021031b52d5dfe407f2bb70045089b69bc29c318a289f1264fb751f6d35cdf26e6856d56b5cabd158b85f0c01423c9c
SSDEEP

196608:z+NOLLzqBCmhHs2ZScpZJNzWdxNPqYWSQDSWREjzOvZPqtjJbcTkE/41s:iGLeBRxs2DZJNadxNSvSDj0ZPqrbukw1

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
3240	oCam_v520.0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3240	2088	oCam_v520.0.exe	73
PID 2088 wrote to memory of 3240	2088	oCam_v520.0.exe	73
PID 2088 wrote to memory of 3240	2088	oCam_v520.0.exe	73

C:\Users\Admin\AppData\Local\Temp\OhSoft OCam 520.0 Multilingual [PeskTop.com]\oCam_v520.0.exe
"C:\Users\Admin\AppData\Local\Temp\OhSoft OCam 520.0 Multilingual [PeskTop.com]\oCam_v520.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\is-RPD7J.tmp\oCam_v520.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RPD7J.tmp\oCam_v520.0.tmp" /SL5="$501FC,8795204,243712,C:\Users\Admin\AppData\Local\Temp\OhSoft OCam 520.0 Multilingual [PeskTop.com]\oCam_v520.0.exe"
  2⤵
  - Executes dropped EXE
  PID:3240

C:\Users\Admin\AppData\Local\Temp\is-RPD7J.tmp\oCam_v520.0.tmp

Filesize
711KB

MD5
bbcaf91c6e4d453daed936b5356e48be

SHA1
184851c888ce14c0fffc5ebeb0547d6b2c856fc9

SHA256
8858bff3a75c55b9afba18b2e65a979dd93f203bf7ee1350c119f0f78e97094a

SHA512
ad2f9e1e698fa54331fb72ee76a7982b13a2b8c4a902d9f511c6d463f1111e2f0537287fb25561043b9415a53cf381d3e6e6cf325aea2986ae86cc8c8bbead0d

Download Submit
memory/2088-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2088-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2088-8-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3240-6-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3240-9-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/3240-12-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download