6e9dc15107b53475b56e86f2b6f339722f39daa6179bdd9f01792fb50800a24a

Analysis

max time kernel
593s
max time network
460s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:58

Target

TreeSize-x64-Full.exe
Size

35.9MB
MD5

3485ea71692d0cfb0f18d20d27fd8bf6
SHA1

ff959ae36df14b2d5a91e20c0f9222b4e5956799
SHA256

6e9dc15107b53475b56e86f2b6f339722f39daa6179bdd9f01792fb50800a24a
SHA512

30c8809e2a97fd2d80d0c646135e9f318fd21162cb3a0f4cbf758e45ef030debc514b5506cc667ae304cd640d4253f8d29f04ff311cdc7cae92621cf11892311
SSDEEP

786432:54AMGgDkEbpZ+gwqRFSProYHDaVl4BsQs1u9IwJ5F/TTTiGggcd:SGNEbp4gwDUgatQsE9IUXrid

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3096	TreeSize-x64-Full.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 3096	4728	TreeSize-x64-Full.exe	84
PID 4728 wrote to memory of 3096	4728	TreeSize-x64-Full.exe	84
PID 4728 wrote to memory of 3096	4728	TreeSize-x64-Full.exe	84

C:\Users\Admin\AppData\Local\Temp\TreeSize-x64-Full.exe
"C:\Users\Admin\AppData\Local\Temp\TreeSize-x64-Full.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\is-4P4FD.tmp\TreeSize-x64-Full.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4P4FD.tmp\TreeSize-x64-Full.tmp" /SL5="$901C0,36592359,857088,C:\Users\Admin\AppData\Local\Temp\TreeSize-x64-Full.exe"
  2⤵
  - Executes dropped EXE
  PID:3096

C:\Users\Admin\AppData\Local\Temp\is-4P4FD.tmp\TreeSize-x64-Full.tmp

Filesize
3.0MB

MD5
648e6e22f02d47bfe02bdaafb663d2d8

SHA1
36f0078a7ea58d332f233b38edfb6efb84ad726c

SHA256
fb33a882ea97a84aefcded00fc307b90a4f1ff02a04706ef452656509edb0b54

SHA512
f5c8fe1aafcd16f9da9d0d92b870c0bfc89d99975115cb0b6ca7d4a45ec460fae64b926652331a16c5c32482dd4f99c59055635b4626055f780c85c55f3ef4d6

Download Submit
memory/3096-6-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/3096-9-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/4728-0-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4728-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/4728-8-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download