c41c7b22f0507b8eddc8d58fd2c066cf157eb78b265089372969a4c09048800b | Triage

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 09:22

Sharing

Report Analysis Logs

General

Target

wolf.cmd
Size

95B
MD5

1ef63d50a423a2b458ed22a1aca2b7be
SHA1

9d7fa00bd1d584622552191be9610166a430e0f5
SHA256

c41c7b22f0507b8eddc8d58fd2c066cf157eb78b265089372969a4c09048800b
SHA512

50896989932c0a8b941aec1953be2b2ce4c867230d4a970839006afb5868818f3751edbd265a5f27a4fd8dd82fa366fae6f138864a681015bf978e469e9c0896

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

pid	Process
928	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 928	4004	cmd.exe	88
PID 4004 wrote to memory of 928	4004	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wolf.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads