40a71220b876aa90ac01ba9c62496a415f2e4a799e391fa9c0cfb11ea6edfea0 | Triage™

Analysis

max time kernel
14s
max time network
115s
platform
windows10_x64
resource
win10v20210410
submitted
16/08/2021, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40a71220b876aa90ac01ba9c62496a415f2e4a799e391fa9c0cfb11ea6edfea0.exe
Size 276KB
Sample210816-gb2pgcnsp6
SHA256 40a71220b876aa90ac01ba9c62496a415f2e4a799e391fa9c0cfb11ea6edfea0
MD5 96b3ab671e6abe11afe7c14a73a6f89b
SHA1 abc698bc7b4ae0c6c73e51e74863dccf245da363
SHA512 4bea5a62de9837690e1aedf6c6f1ec69130bb5a392ae05d93ddfacb7486b0b498444965921d79e5bc183d06c5f8defb25c396d0b19665aea1b4b6af8a969d892
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 752	2288	40a71220b876aa90ac01ba9c62496a415f2e4a799e391fa9c0cfb11ea6edfea0.exe	75
PID 2288 wrote to memory of 752	2288	40a71220b876aa90ac01ba9c62496a415f2e4a799e391fa9c0cfb11ea6edfea0.exe	75

C:\Users\Admin\AppData\Local\Temp\40a71220b876aa90ac01ba9c62496a415f2e4a799e391fa9c0cfb11ea6edfea0.exe
"C:\Users\Admin\AppData\Local\Temp\40a71220b876aa90ac01ba9c62496a415f2e4a799e391fa9c0cfb11ea6edfea0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo your mom went to college > C:\Users\Admin\AppData\LocalLow\ch3rn0byl.txt
  2⤵
  PID:752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads