e2b3c3478fc9d5e4e126e320c4a95a307ef506d43f91bc409609d11ead67048a | Triage

Resubmissions

09/01/2023, 22:43

230109-2nbttagb26 1

09/01/2023, 22:41

230109-2mk14abe6x 1

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09/01/2023, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

pdisretarded2.exe
Size

2.3MB
MD5

1e6214772cbd64d9bbf226716228560b
SHA1

4bc557d253e363151f6509b600f7d7c4eddfd23d
SHA256

e2b3c3478fc9d5e4e126e320c4a95a307ef506d43f91bc409609d11ead67048a
SHA512

55bc9841d61fde4cd102ccef5c114b407f59b55956557681f9c2e72160a498964f8f65021819b41c30c9d9a92336453b30aa569d25369036613e99743b1dfeb4
SSDEEP

49152:jweBa7AyvysXznaWWG/f7X1iVfSPMhR+3MTuKaUarxNb1:jweBGAWysXGtG3Yt9hR+3O

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 856	1800	pdisretarded2.exe	29
PID 1800 wrote to memory of 856	1800	pdisretarded2.exe	29
PID 1800 wrote to memory of 856	1800	pdisretarded2.exe	29
PID 1800 wrote to memory of 856	1800	pdisretarded2.exe	29
PID 1800 wrote to memory of 564	1800	pdisretarded2.exe	30
PID 1800 wrote to memory of 564	1800	pdisretarded2.exe	30
PID 1800 wrote to memory of 564	1800	pdisretarded2.exe	30
PID 1800 wrote to memory of 564	1800	pdisretarded2.exe	30
PID 1800 wrote to memory of 1288	1800	pdisretarded2.exe	31
PID 1800 wrote to memory of 1288	1800	pdisretarded2.exe	31
PID 1800 wrote to memory of 1288	1800	pdisretarded2.exe	31
PID 1800 wrote to memory of 1288	1800	pdisretarded2.exe	31

C:\Users\Admin\AppData\Local\Temp\pdisretarded2.exe
"C:\Users\Admin\AppData\Local\Temp\pdisretarded2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c color d
  2⤵
  PID:564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download