9e73fbc799272df3a85b6ef77894b061d91e5214a67ed2f1dd8b91f981b57ac5 | Triage™

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/02/2023, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vibrations/floodlight.cmd
Size 239B
Sample230223-jbj1jsfa99
SHA256 86117f16adb7a919d320c5a105099fbdb64a18274ba78bb33d5b072e6fa0fbfc
MD5 4f4d7d05a2e6eac735471a6e31e435fc
SHA1 998870f26d8ab35561ebdfcd90a6f2dd0a646b43
SHA512 1f31f1bd645546295c545559d2fba033c039c9e2ca3a9bdb2b5545192cfa2c3aa3a2ceb9a3982652cf0f48bd801a72642753519fc02d6417f03dc4bd1f330f17
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2040	2044	cmd.exe	28
PID 2044 wrote to memory of 2040	2044	cmd.exe	28
PID 2044 wrote to memory of 2040	2044	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\vibrations\floodlight.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\rundll32.exe
  rundll32 c:\users\public\output2.txt,N115
  2⤵
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads