d41514f34250dcb5910a8bb4808b97df2dbfc70cd19c932f785c66729c9f83d0 | Triage

Analysis

max time kernel
121s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 19:00

Sharing

Report Analysis Logs

General

Target

d6e064257e11b8f9d9c1f8275d3c6f12.exe
Size

18KB
MD5

d6e064257e11b8f9d9c1f8275d3c6f12
SHA1

6252acdab6c0d9e9518c15dc4679d97a199d6281
SHA256

d41514f34250dcb5910a8bb4808b97df2dbfc70cd19c932f785c66729c9f83d0
SHA512

8bdb6eba9b605b5f22dbc4b3147f41509e9ff1760da884a32d74656a27b1d3cf91ee586f35cadacef9c45f5f4da05b0ed80e01199ea512e458ce7475073ae319
SSDEEP

384:BAfjn5h2MtwMF77zOzrKalmAKZ6ERLhH6vT:Bg8+37vOiZ6EvH6b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 5100	2328	d6e064257e11b8f9d9c1f8275d3c6f12.exe	97
PID 2328 wrote to memory of 5100	2328	d6e064257e11b8f9d9c1f8275d3c6f12.exe	97
PID 2328 wrote to memory of 5100	2328	d6e064257e11b8f9d9c1f8275d3c6f12.exe	97

C:\Users\Admin\AppData\Local\Temp\d6e064257e11b8f9d9c1f8275d3c6f12.exe
"C:\Users\Admin\AppData\Local\Temp\d6e064257e11b8f9d9c1f8275d3c6f12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\b.bat "C:\Users\Admin\AppData\Local\Temp\d6e064257e11b8f9d9c1f8275d3c6f12.exe"
  2⤵
  PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b.bat

Filesize
56B

MD5
53bfe5e56ee7fe6f911a69d63ec75bb0

SHA1
0749a7e178f0cf1bec7560adc3dffeafba8bcd59

SHA256
2393a34e810100dad1765d5f5d6e732a3288257381897fdbe2054de7044b7af6

SHA512
a3fb118e01a6b04695b8999cdaa2eae525604bef398945d31ebdc318d1b15b89fb61b4f15139f78651047a697247b496690077bef3657c1738575d83a10262e6

Download Submit