f4b160d4f2f46dfde9f4d6fefb40e4e187666a050286f5367138fd6e593069af | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 21:42

Sharing

Report Analysis Logs

General

Target

rad_windows_amd64.exe
Size

17.5MB
MD5

e27b241f28012a67d5fc63c65656769f
SHA1

dff0dd2d853122b35a38f30dbcb89f342ee3d0d7
SHA256

f4b160d4f2f46dfde9f4d6fefb40e4e187666a050286f5367138fd6e593069af
SHA512

c1872ccb997135360548efb41d259764d7436d6ed379de575f5b3c4c18c2d875073e206b636f15a728c82908f6bf431171100e660f79217a72a87689f49c7d9a
SSDEEP

196608:6/zxYBmJ9qC8sJKGbZ6H+kEZ8RnmfvABg4Chf/E+BfMH3:AqBmemPs8Vlb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3040	2928	rad_windows_amd64.exe	29
PID 2928 wrote to memory of 3040	2928	rad_windows_amd64.exe	29
PID 2928 wrote to memory of 3040	2928	rad_windows_amd64.exe	29

C:\Users\Admin\AppData\Local\Temp\rad_windows_amd64.exe
"C:\Users\Admin\AppData\Local\Temp\rad_windows_amd64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads