8fd16df0f4ce1bcbf6390f6e03c0b23c0d6817300332641ca11afb809eaaeae0 | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

t.exe
Size

3.6MB
MD5

2f57c0739f29168c77e6b5f7a972f686
SHA1

9fc158a5030d527d41273933d444fb6c79f80cea
SHA256

8fd16df0f4ce1bcbf6390f6e03c0b23c0d6817300332641ca11afb809eaaeae0
SHA512

fb276b0d036b8f577fb77acb4eb0b44cc5954f070dcbaea1b5128da9dbe25b66d6d51fd15638a7548f037040b0385be102fdf51983dc77b5c17c12cd89ba387b
SSDEEP

49152:yZ4r5WjLgUj0fIFhsQ/NG/VQo3EaOdQgFJ2CRU2qRo:RmrXsQQzElRUG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4952	3592	t.exe	25
PID 3592 wrote to memory of 4952	3592	t.exe	25

C:\Users\Admin\AppData\Local\Temp\t.exe
"C:\Users\Admin\AppData\Local\Temp\t.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe"
  2⤵
  PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads