6fd01e7c046a0dbee635b69f5457a6d62405fd16faa30b708b8ecf41847867fd | Triage

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 02:06

Sharing

Report Analysis Logs

General

Target

hscan.exe
Size

128KB
MD5

6263b67a59dad81aecae69276d265e1f
SHA1

568b06696ea0270ee1a744a5ac16418c8dacde1c
SHA256

7418d747940adba7a9b93dd8e3a9c470194f8e442983f129dd9f19431c8963b9
SHA512

75d658a9cfc75e98b2c987ade0e19698a54d00e57c3618a54568341bef41192a9b2cbb53ee557035af89823cad8be60b0950eeb18fd6fe39b4f6a1fb7c7a44d1
SSDEEP

3072:vuwdE4JQCqrdrjL5eUIzePrykrSoZj7B:v1E4JQCqrdr4UMePryE7B

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3020	1376	hscan.exe	83
PID 1376 wrote to memory of 3020	1376	hscan.exe	83
PID 1376 wrote to memory of 3020	1376	hscan.exe	83

C:\Users\Admin\AppData\Local\Temp\hscan.exe
"C:\Users\Admin\AppData\Local\Temp\hscan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-0-0x0000000001110000-0x0000000001125000-memory.dmp

Filesize
84KB

Download
memory/1376-1-0x0000000001110000-0x0000000001125000-memory.dmp

Filesize
84KB

Download