8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e

Analysis

max time kernel
83s
max time network
204s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16/04/2024, 19:36

Target

dragon_install.exe
Size

38KB
MD5

54ca748e529703533a7bf1f98df48e8b
SHA1

a1ebc6154dfa79ab6a4db457cda2227d3cb48f3d
SHA256

7a52ce0ff8671e4766b49d80465a76b43eb67f1d82b2453df8615779183fccc4
SHA512

5085f51d8cc05e3f02c756fcc77f0ef8b9849fbf1e43ec6557ba46bf486b3be1c1c8ed3feaa873811b27c4ea20b03b92704fefb9eea8a8e0a7422707fe152267
SSDEEP

384:kqIkibl1lYnm2WJXtl/bQ/FP8J2aMSgp4aRcxrWf/PzrK4erMqPg96wFwkjvpHXR:BBBGvUp8J2UTdKSEqGHlkvbrwAyiRPw

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2416	4092	dragon_install.exe	79
PID 4092 wrote to memory of 2416	4092	dragon_install.exe	79

C:\Users\Admin\AppData\Local\Temp\dragon_install.exe
"C:\Users\Admin\AppData\Local\Temp\dragon_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c start ms-settings:defaultapps
  2⤵
  PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3952

memory/4092-0-0x0000028A0E8F0000-0x0000028A0E8FE000-memory.dmp

Filesize
56KB

Download
memory/4092-1-0x00007FF868A90000-0x00007FF869552000-memory.dmp

Filesize
10.8MB

Download
memory/4092-3-0x00007FF868A90000-0x00007FF869552000-memory.dmp

Filesize
10.8MB

Download