c72289d015d5661eea3043a76d53c92e72b164527468a3b547fd3e8585fc1cdd | Triage

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 07:03

Sharing

Report Analysis Logs

General

Target

udpmod.exe
Size

125KB
MD5

4424c025297c4bf3c490741e2446cc72
SHA1

0ef933b2122da1ecd5e7a4ab3853868525db57d0
SHA256

f0939f786ae6bc5aaa3d14fcc5ecfdf71618629999bf772270ab45430b46d978
SHA512

cfbc880f890e3760408516ca0bc8efe866c13082964d5f66f9febbd668b99a094355e523809c7d45a1e3874483f3bd2034b398a9baa96a1458c7ae9760ccfe95

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

udpmod.exe

description	pid	process	target process
PID 676 wrote to memory of 324	676	udpmod.exe	cmd.exe
PID 676 wrote to memory of 324	676	udpmod.exe	cmd.exe
PID 676 wrote to memory of 324	676	udpmod.exe	cmd.exe
PID 676 wrote to memory of 324	676	udpmod.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\udpmod.exe
"C:\Users\Admin\AppData\Local\Temp\udpmod.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:676

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:324

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/324-54-0x0000000000000000-mapping.dmp

Download