86dd5c4f5c19f4a1403c31548f0a6d72d23a4fc8f7642a9044712f6710cfe7af | Triage

Analysis

max time kernel
123s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 03:48

Sharing

Report Analysis Logs

General

Target

Needy Streamer Overload [FitGirl Repack]/Verify BIN files before installation.bat
Size

69B
MD5

a3a1d3f8400dbcefeed01fc6293644ff
SHA1

d6445e7814729612aca5952b3c0bd6b5328b6a20
SHA256

95ff8038ebfcdbdbf8fbfd047447b0418e960c2a2dcb20515ee3c5e8349a5540
SHA512

e50706a605f53eb4534cc699454d5f8552617d7dcf87f970debb44d1cafb41a42d132188452cb0d41f0ce55762ee8aea332a9b5b9410aa99a265473595cc8a67

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4580	QuickSFV.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 4580	1492	cmd.exe	80
PID 1492 wrote to memory of 4580	1492	cmd.exe	80
PID 1492 wrote to memory of 4580	1492	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Needy Streamer Overload [FitGirl Repack]\Verify BIN files before installation.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\Needy Streamer Overload [FitGirl Repack]\MD5\QuickSFV.EXE
  QuickSFV.EXE fitgirl-bins.md5
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads