953a413b8d78b8328a6dc1cc1fe9e9f4314e3c95a284aec5f09d1de9bdc82a91 | Triage

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 07:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

proofens.exe
Size

92KB
MD5

308649555ed486fc218c379ea62c9ccc
SHA1

19428cff79a8505944199e01c39d185bf6588e7f
SHA256

e62bb68843ff6b9e702ba1e80661c0599b25cf9eda5aa0b5bab70a7f369f70d6
SHA512

9f1db5e332c2a6656f443899476129512103ac79af251a468b7db52a2a473131d8da3c99317aab3fcccc4176e02d3091c1df5390e5f3b377609193a9d72c5748
SSDEEP

1536:d4+RR0J8BO6cpl6jLO2jJon8H1GyIttkrrZlORM9/g:iYxORUxdi7orZlO+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4828	4508	proofens.exe	83
PID 4508 wrote to memory of 4828	4508	proofens.exe	83
PID 4508 wrote to memory of 4828	4508	proofens.exe	83

C:\Users\Admin\AppData\Local\Temp\proofens.exe
"C:\Users\Admin\AppData\Local\Temp\proofens.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c color 8
  2⤵
  PID:4828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads