11e2b985fdf2086c44a3b96f8af2600630e02cfbae0d6a68b76f4ad1427a7c56 | Triage

Analysis

max time kernel
107s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

TruckDriver.ARMADOYTESTEADO/Verify BIN files before installation.bat
Size

69B
MD5

a3a1d3f8400dbcefeed01fc6293644ff
SHA1

d6445e7814729612aca5952b3c0bd6b5328b6a20
SHA256

95ff8038ebfcdbdbf8fbfd047447b0418e960c2a2dcb20515ee3c5e8349a5540
SHA512

e50706a605f53eb4534cc699454d5f8552617d7dcf87f970debb44d1cafb41a42d132188452cb0d41f0ce55762ee8aea332a9b5b9410aa99a265473595cc8a67

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3700	3488	cmd.exe	86
PID 3488 wrote to memory of 3700	3488	cmd.exe	86
PID 3488 wrote to memory of 3700	3488	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TruckDriver.ARMADOYTESTEADO\Verify BIN files before installation.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\TruckDriver.ARMADOYTESTEADO\MD5\QuickSFV.EXE
  QuickSFV.EXE fitgirl-bins.md5
  2⤵
  PID:3700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads