1ca93fdcc11135777684369edc2bb27d287ffa05d09533c69107e88c153d96c2 | Triage

Analysis

max time kernel
298s
max time network
319s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09-04-2024 00:22

Sharing

Report Analysis Logs

General

Target

Wave/dist/start.cmd
Size

11B
MD5

3a6deb11e01a2191a3819f0a6364d95c
SHA1

e6ecc23bfd21a7a237c4e036741e0806659e86fc
SHA256

51e2aec7acfef86caefa3739b1d373b29809156df836793ac15d4af93d32fea6
SHA512

01fe050212b12bab96d605674a93ae98e8f498dcc17815c0ea7233e42c005483c9f5de1dcde734987012830106f0b40dccadc42e566aac49ed3cf37e986eea01

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4376 wrote to memory of 2940 4376 cmd.exe node.exe
PID 4376 wrote to memory of 2940 4376 cmd.exe node.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Wave\dist\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4376

C:\Users\Admin\AppData\Local\Temp\Wave\dist\node.exe
node server
2⤵
PID:2940

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...