645f257200f2c3256f6c2287853296da2a91c710cebfbce7749271b66ff22245 | Triage

Analysis

max time kernel
30s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2023, 20:12

Sharing

Report Analysis Logs

General

Target

MTADiag.exe
Size

279KB
MD5

fa834d0f8bb50f2eac6384518a16ef54
SHA1

75a4ca8a55ac80051ee2ce3ac20a377486684e84
SHA256

645f257200f2c3256f6c2287853296da2a91c710cebfbce7749271b66ff22245
SHA512

01f2e4945c0957e64cbf5b4b4fe03cd5716617fd25d602442ef20f297d50a113ca76f709bf8c84a7b8ec2f9b5187f8f0d72a4e885c1a7d1e2d4f13e254e4a3d6
SSDEEP

6144:XeB7lFnJvAvSWac8RJVn/hnW3Vzy7NFZvSSALavtXsgQk+:XejFnJIv4Wxy7BOQXRK

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/4200-0-0x0000000000C40000-0x0000000000CF0000-memory.dmp	upx
behavioral1/memory/4200-1-0x0000000000C40000-0x0000000000CF0000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4816	4200	MTADiag.exe	88
PID 4200 wrote to memory of 4816	4200	MTADiag.exe	88
PID 4200 wrote to memory of 4816	4200	MTADiag.exe	88

C:\Users\Admin\AppData\Local\Temp\MTADiag.exe
"C:\Users\Admin\AppData\Local\Temp\MTADiag.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4200-0-0x0000000000C40000-0x0000000000CF0000-memory.dmp

Filesize
704KB

Download
memory/4200-1-0x0000000000C40000-0x0000000000CF0000-memory.dmp

Filesize
704KB

Download