d01b49ea8c4f9215e0838147fb4eb5909c6298e9f1314e7401faf0d6cbc5d9e0 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 11:15

Sharing

Report Analysis Logs

General

Target

reducer.exe
Size

29KB
MD5

113b4c92dca5eb03fef7916d9d3216be
SHA1

231a7949ef5eb2fadf148884742b40d32e71cdd7
SHA256

d01b49ea8c4f9215e0838147fb4eb5909c6298e9f1314e7401faf0d6cbc5d9e0
SHA512

fe348660ff1d08b937178466852c04042db6fa0ceda6981c7cdff726e6629741d1170bfee6be16c115a9df1d2a3177b985ade216a137d2f6f83fbd2ab199cd10
SSDEEP

768:KMLDTH3XaAy8MM9cmtqTbUh/W2pfAIxsXo:PHiS9cIhe2pI3o

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2996	2964	reducer.exe	29
PID 2964 wrote to memory of 2996	2964	reducer.exe	29
PID 2964 wrote to memory of 2996	2964	reducer.exe	29

C:\Users\Admin\AppData\Local\Temp\reducer.exe
"C:\Users\Admin\AppData\Local\Temp\reducer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads