bd2b126d573abdf7a1f05e469fa513e974ac9df22de34beb9c00345259ffe29c | Triage

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f6ecb987ea8f4d36c248711070cd1208.exe
Size

36KB
MD5

f6ecb987ea8f4d36c248711070cd1208
SHA1

3c2b96308ffa33c5705df9e2ea0601c7a1bd7dc7
SHA256

bd2b126d573abdf7a1f05e469fa513e974ac9df22de34beb9c00345259ffe29c
SHA512

522e73459155bfea8edb5dccff5c416db9362f5e16cb4b9aea79f1fc436eef47a0dc529c245de53ec91730cf811187bda4280a543cd55e05138fed85bdcde408
SSDEEP

384:cHP1qaBKxCd7PpLjzKb29lKDYyKsez8/tK:cHPdBKYXx48zso8/tK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 3804	408	f6ecb987ea8f4d36c248711070cd1208.exe	89
PID 408 wrote to memory of 3804	408	f6ecb987ea8f4d36c248711070cd1208.exe	89
PID 408 wrote to memory of 3804	408	f6ecb987ea8f4d36c248711070cd1208.exe	89

C:\Users\Admin\AppData\Local\Temp\f6ecb987ea8f4d36c248711070cd1208.exe
"C:\Users\Admin\AppData\Local\Temp\f6ecb987ea8f4d36c248711070cd1208.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\WINDOWS\system32\wefcvysewb.sd,mymain
  2⤵
  PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads