dd80377d721cd7348ba9090107917d5880231eefcf4acc685cada0ebbb8a5460

Analysis

max time kernel
170s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 21:25

Target

peazip-9.7.1.WIN64.exe
Size

9.3MB
MD5

b3c25a3198e2c855d27594475851a1db
SHA1

96e88c704e9c3b21f5fd93d9b28252621be256f0
SHA256

dd80377d721cd7348ba9090107917d5880231eefcf4acc685cada0ebbb8a5460
SHA512

5f36386be8a54c0fe914b860ad17a81271f7e64a56c21c106da7604f3576759fded5e7a8e9c48f8572fde3312cdc3f9649e2ad227894872deacd206a9494ea14
SSDEEP

196608:uizLiN3H44w32YcOF6tCzo6tR4RZJSzpsz18:uiz9RFGIR4RZEqz18

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2524	peazip-9.7.1.WIN64.tmp

Loads dropped DLL 1 IoCs

pid	Process
2592	peazip-9.7.1.WIN64.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2524	2592	peazip-9.7.1.WIN64.exe	29
PID 2592 wrote to memory of 2524	2592	peazip-9.7.1.WIN64.exe	29
PID 2592 wrote to memory of 2524	2592	peazip-9.7.1.WIN64.exe	29
PID 2592 wrote to memory of 2524	2592	peazip-9.7.1.WIN64.exe	29
PID 2592 wrote to memory of 2524	2592	peazip-9.7.1.WIN64.exe	29
PID 2592 wrote to memory of 2524	2592	peazip-9.7.1.WIN64.exe	29
PID 2592 wrote to memory of 2524	2592	peazip-9.7.1.WIN64.exe	29

C:\Users\Admin\AppData\Local\Temp\peazip-9.7.1.WIN64.exe
"C:\Users\Admin\AppData\Local\Temp\peazip-9.7.1.WIN64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\is-KQ5AK.tmp\peazip-9.7.1.WIN64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KQ5AK.tmp\peazip-9.7.1.WIN64.tmp" /SL5="$5015C,9274462,151552,C:\Users\Admin\AppData\Local\Temp\peazip-9.7.1.WIN64.exe"
  2⤵
  - Executes dropped EXE
  PID:2524

\Users\Admin\AppData\Local\Temp\is-KQ5AK.tmp\peazip-9.7.1.WIN64.tmp

Filesize
1.2MB

MD5
889c8ef91ac310544d1539ac3cdc0f07

SHA1
3ccb4c5ff6c419599138bcce43a70780a9570871

SHA256
7ba798767f82812cc3bfba370b6797fd29ecdcddc52baf967a52773edee4a0c7

SHA512
a25353e243a4db84d0262210eacb6ce07b13bed982e347cba085d6d7b895a781c00524739477baec5eac186b65e65da0cca0315bb8f3abcd250ab032d866d2a3

Download Submit
memory/2524-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2524-11-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/2524-14-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2592-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2592-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download