8ed37ef548e03cbe854f4c2aec9911f3acefb53df4eb4992dddcbff45d95c368 | Triage

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2023 14:49

Sharing

Report Analysis Logs

General

Target

frftofr3.exe
Size

4.0MB
MD5

e416b46618333ee6850f9441eb53ce68
SHA1

79a15878d26d7385da501541b48bc068cac0b0b5
SHA256

8ed37ef548e03cbe854f4c2aec9911f3acefb53df4eb4992dddcbff45d95c368
SHA512

6620bca418c7d2369a78a8d77e423da2bd27b4aff25679379fc89c9396d218529a38481b39da9f554edc5e93a71d09468af3b6df9d1326c14e3ecd08d159812a
SSDEEP

49152:dGZTnyd4OXM/LPe7AMYfhhxJU1hz4uV38EK+eTQTBhiTkBhRx:dGZdOc7DxJU1HsEK+9Ewx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4704	4348	frftofr3.exe	80
PID 4348 wrote to memory of 4704	4348	frftofr3.exe	80

C:\Users\Admin\AppData\Local\Temp\frftofr3.exe
"C:\Users\Admin\AppData\Local\Temp\frftofr3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4348-133-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4348-134-0x0000000000400000-0x000000000080B000-memory.dmp

Filesize
4.0MB

Download
memory/4348-135-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download