4051d791566f289683ee377effd774a80b7eb2b251e604e3eeabf923d75c0c98 | Triage

Resubmissions

19-10-2023 11:09

231019-m9hf6agh68 10

Analysis

max time kernel
408s
max time network
426s
platform
windows10-2004_x64
resource
win10v2004-20230915-ja
resource tags

arch:x64arch:x86image:win10v2004-20230915-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
19-10-2023 11:09

Sharing

Report Analysis Logs

General

Target

NirCMD 2.8.1/nircmd.exe
Size

43KB
MD5

84d499f558570c32f4cb100a9124890b
SHA1

9adfc7ab66348d84ebdd9c1e8093cad4cc8485ef
SHA256

31b3b228382dc359f22ae97b2602eee81dc743fb21196061eacc6619533881f5
SHA512

560aaadebcbd425d35fc3a567c987a5f15a5f091962328f0479c1ec2378c732cca892eb3252179c8895413b0f3d08f44fbcf8c9d2375877c81622f42e6549c86
SSDEEP

768:e4OBw5XDtS0d0xr6xczY6jU19q2T5D8EZdZzaJqn:+wtDtS0yV6B6A19FTiEZXaJqn

Score

9^/10

upx

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
behavioral10/memory/4888-1-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral10/memory/4888-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral10/memory/4888-1-0x0000000000400000-0x000000000041B000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exe
"C:\Users\Admin\AppData\Local\Temp\NirCMD 2.8.1\nircmd.exe"
1⤵
PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4888-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4888-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download