1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808 | Triage

Analysis

max time kernel
149s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-06-2022 14:04

Sharing

Report Analysis Logs

General

Target

1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe
Size

56KB
MD5

5fe957ba6dc8c255da706b7bb2af5388
SHA1

7966db247cf123b31f89715b8510aaebbd14e185
SHA256

1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808
SHA512

15f42a64291a4bb5e60204d34a12054d4010d5d120da00b52030a87ad1569d43d4529016fbdcf64f662dd09cf81ab83f8b360aacc74b075f0c9092d04885942b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 5076	2180	1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe	81
PID 2180 wrote to memory of 5076	2180	1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe	81
PID 2180 wrote to memory of 5076	2180	1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe	81

C:\Users\Admin\AppData\Local\Temp\1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe
"C:\Users\Admin\AppData\Local\Temp\1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe"
  2⤵
  PID:5076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-130-0x0000000000C90000-0x0000000000C9B000-memory.dmp

Filesize
44KB

Download