39a747ccd109713f450de38db02800fad4a4efcf9d5f037dde50482376186688 | Triage

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 09:03

Sharing

Report Analysis Logs

General

Target

39a747ccd109713f450de38db02800fad4a4efcf9d5f037dde50482376186688.exe
Size

72KB
MD5

43c959db7ad5d430dfff9468cfac217c
SHA1

40d92f19f405c0a9b12d291ed0997e6eef9aafc1
SHA256

39a747ccd109713f450de38db02800fad4a4efcf9d5f037dde50482376186688
SHA512

b7e49a5aaae0bda02e82c2acf45903b2268fd446c1e88cd4b9cff2aab2441b981233911fcf6f065a549fc2ac81e2aa4168257756f723f0f43e09e000df13a3b8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

39a747ccd109713f450de38db02800fad4a4efcf9d5f037dde50482376186688.exe

description	pid	process	target process
PID 3744 wrote to memory of 324	3744	39a747ccd109713f450de38db02800fad4a4efcf9d5f037dde50482376186688.exe	cmd.exe
PID 3744 wrote to memory of 324	3744	39a747ccd109713f450de38db02800fad4a4efcf9d5f037dde50482376186688.exe	cmd.exe
PID 3744 wrote to memory of 324	3744	39a747ccd109713f450de38db02800fad4a4efcf9d5f037dde50482376186688.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\39a747ccd109713f450de38db02800fad4a4efcf9d5f037dde50482376186688.exe
"C:\Users\Admin\AppData\Local\Temp\39a747ccd109713f450de38db02800fad4a4efcf9d5f037dde50482376186688.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/324-130-0x0000000000000000-mapping.dmp

Download