86dd5c4f5c19f4a1403c31548f0a6d72d23a4fc8f7642a9044712f6710cfe7af | Triage

Analysis

max time kernel
31s
max time network
54s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 03:48

Sharing

Report Analysis Logs

General

Target

Needy Streamer Overload [FitGirl Repack]/Verify BIN files before installation.bat
Size

69B
MD5

a3a1d3f8400dbcefeed01fc6293644ff
SHA1

d6445e7814729612aca5952b3c0bd6b5328b6a20
SHA256

95ff8038ebfcdbdbf8fbfd047447b0418e960c2a2dcb20515ee3c5e8349a5540
SHA512

e50706a605f53eb4534cc699454d5f8552617d7dcf87f970debb44d1cafb41a42d132188452cb0d41f0ce55762ee8aea332a9b5b9410aa99a265473595cc8a67

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
984	QuickSFV.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 984	1160	cmd.exe	28
PID 1160 wrote to memory of 984	1160	cmd.exe	28
PID 1160 wrote to memory of 984	1160	cmd.exe	28
PID 1160 wrote to memory of 984	1160	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Needy Streamer Overload [FitGirl Repack]\Verify BIN files before installation.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\Needy Streamer Overload [FitGirl Repack]\MD5\QuickSFV.EXE
  QuickSFV.EXE fitgirl-bins.md5
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-55-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download