1b62679a7dd555ec5a3c8dd0641a7b3c99c11263a4f3d8a4c256965bdc75ecbd | Triage™

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14/07/2022, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
696ea26bda4b0fab70aa35315aa89149.exe
Size 3.3MB
Sample220714-hr4t8abcdp
SHA256 1b62679a7dd555ec5a3c8dd0641a7b3c99c11263a4f3d8a4c256965bdc75ecbd
MD5 696ea26bda4b0fab70aa35315aa89149
SHA1 083dcf2c765df863ee34353559a885357628e145
SHA512 6247d8d1020878a872d6e4efe80efb58fa6c5f3939bfb88368c8b528687f176800eaea2fa94e187093801631b6a68d7dbd0708e8efd360d2e9fc9ef0a378c7b5
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 1532	4528	696ea26bda4b0fab70aa35315aa89149.exe	84
PID 4528 wrote to memory of 1532	4528	696ea26bda4b0fab70aa35315aa89149.exe	84

C:\Users\Admin\AppData\Local\Temp\696ea26bda4b0fab70aa35315aa89149.exe
"C:\Users\Admin\AppData\Local\Temp\696ea26bda4b0fab70aa35315aa89149.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads