9e73fbc799272df3a85b6ef77894b061d91e5214a67ed2f1dd8b91f981b57ac5 | Triage™

Analysis

max time kernel
71s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2023, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vibrations/floodlight.cmd
Size 239B
Sample230223-jbj1jsfa99
SHA256 86117f16adb7a919d320c5a105099fbdb64a18274ba78bb33d5b072e6fa0fbfc
MD5 4f4d7d05a2e6eac735471a6e31e435fc
SHA1 998870f26d8ab35561ebdfcd90a6f2dd0a646b43
SHA512 1f31f1bd645546295c545559d2fba033c039c9e2ca3a9bdb2b5545192cfa2c3aa3a2ceb9a3982652cf0f48bd801a72642753519fc02d6417f03dc4bd1f330f17
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 2508	4672	cmd.exe	82
PID 4672 wrote to memory of 2508	4672	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vibrations\floodlight.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\system32\rundll32.exe
  rundll32 c:\users\public\output2.txt,N115
  2⤵
  PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads