c4a23bb6f2f1cb4b5a9cc64927c27b69b269f853da89ba0e67ef1f15695873cd | Triage

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 12:48

Sharing

Report Analysis Logs

General

Target

KunLauncher.exe
Size

245KB
MD5

9cd1f9b68d0a6371097dfbfcb79ea08a
SHA1

b9642039a5006f17da6e96fd4f0a73d7fd327a49
SHA256

058d6d7d8fce917aa890d8d8284fb3a02cb7dcfbc0d7120719692ed9204c533e
SHA512

eb821878ce96b68e263859c350527ebe27082e9e18f4dd9bbb5a13f79a32ce67c66bc7442e82f7e4d7de50f75de427ef5a726c96b58c7c1e744e592279fa32f4
SSDEEP

6144:Afz4WtbiUJfIyDUXsW7SHS5DCiAOquTCl:Avi6IyYwiYUCl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1280	4912	KunLauncher.exe	90
PID 4912 wrote to memory of 1280	4912	KunLauncher.exe	90
PID 4912 wrote to memory of 1280	4912	KunLauncher.exe	90

C:\Users\Admin\AppData\Local\Temp\KunLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\KunLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads