8fb707fe0323280a191fc45579ec97672caaa3ca7d6c02be8a34653d46c519d8 | Triage

Analysis

max time kernel
291s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2023 11:56

Sharing

Report Analysis Logs

General

Target

nc64.exe
Size

44KB
MD5

523613a7b9dfa398cbd5ebd2dd0f4f38
SHA1

3e92f697d642d68bb766cc93e3130b36b2da2bab
SHA256

3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571
SHA512

2ca42e21ebc26233c3822851d9fc82f950186820e10d3601c92b648415eb720f0e1a3a6d9d296497a3393a939a9424c47b1e5eaedfd864f96e3ab8986f6b35b5
SSDEEP

768:gaGHu/aKUAvRCXA/e6PfVVCJrxg/KKjMozd6jSemG0nf2Fcc5C+qLaVp:CuSzAvRCxmNVCgi+IjNmDO15C+qLaVp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

nc64.exe

description pid process target process

PID 4644 wrote to memory of 916 4644 nc64.exe cmd.exe
PID 4644 wrote to memory of 916 4644 nc64.exe cmd.exe

C:\Users\Admin\AppData\Local\Temp\nc64.exe
"C:\Users\Admin\AppData\Local\Temp\nc64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4644-133-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4644-137-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download