0c760dc5e36c4a50915575b71a903f804a58528af063adeab0122b1dacebe762

Analysis

max time kernel
164s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 04:54

Target

ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.exe
Size

21.8MB
MD5

281de22d5f870e7ce255cb31cd8d8867
SHA1

43c6221bc905f272e9bae18fdc60f7cf05a87b55
SHA256

0c760dc5e36c4a50915575b71a903f804a58528af063adeab0122b1dacebe762
SHA512

f04daa0d2edcbed911fa4b666e7ad6103d3504f5f0b32823d3952f7696abbd4225fdc2d549a65f0c5c8b1a6f15abdd712e26e9b88512f49920c821d0c4002046
SSDEEP

393216:7MRrytp2ZOPBv1PDQLfVkwj/5rkbr8u+y+EeQaS5xegXqEVnSU0uOY+lcx:k2eAJtDQDaYzFMaCO1lQ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4572	ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 260 wrote to memory of 4572	260	ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.exe	97
PID 260 wrote to memory of 4572	260	ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.exe	97
PID 260 wrote to memory of 4572	260	ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.exe	97

C:\Users\Admin\AppData\Local\Temp\ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.exe
"C:\Users\Admin\AppData\Local\Temp\ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:260
- C:\Users\Admin\AppData\Local\Temp\is-TCE58.tmp\ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TCE58.tmp\ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.tmp" /SL5="$D0048,21951580,831488,C:\Users\Admin\AppData\Local\Temp\ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.exe"
  2⤵
  - Executes dropped EXE
  PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:3336

C:\Users\Admin\AppData\Local\Temp\is-TCE58.tmp\ImageMagick-7.1.1-29-Q16-HDRI-x64-dll.tmp

Filesize
3.0MB

MD5
82755aeee605ff4e182d0bd6c44d22d5

SHA1
71be02e217e2b0413a295c92f3a300458d75cd97

SHA256
9b9f2ebeac646bf524e167d5f67606a7b18d23061560779c40b7b18ac6dd0f4a

SHA512
2d2e739931a72305bbe7f75f7354ce17e2337cc6ba17f56cd83d16aff26dc41698deb635b291f44dc5300dfaf6f4e3d4d5491245331945b53753610dc62d3b1d

Download Submit
memory/260-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/260-7-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4572-5-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4572-8-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/4572-10-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/4572-12-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4572-13-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/4572-15-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download