5407e6ece7662604d7396f62fda11798738c8be2a2b722c990c398adacbb1779 | Triage

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 02:16

Sharing

Report Analysis Logs

General

Target

4d243021e90bd0418987cd20ea88f440N.exe
Size

72KB
MD5

4d243021e90bd0418987cd20ea88f440
SHA1

2239a030344595de505abdac491702cc59b9134a
SHA256

5407e6ece7662604d7396f62fda11798738c8be2a2b722c990c398adacbb1779
SHA512

07f492f935c5b4442bf8d89c32329ed53fdd10dd447f3cd2e7dc008a53a6e4fef6dc7d418ad045ff1f87f53317b6ed798e46313ae765e22c58f572ca9d55fa6a
SSDEEP

1536:ILTYdVOXog5KtNuEzzy45xD3uqBGMb+KR0Nc8QsJq39:u4g4i+Ge0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 3480	3876	4d243021e90bd0418987cd20ea88f440N.exe	84
PID 3876 wrote to memory of 3480	3876	4d243021e90bd0418987cd20ea88f440N.exe	84
PID 3876 wrote to memory of 3480	3876	4d243021e90bd0418987cd20ea88f440N.exe	84

C:\Users\Admin\AppData\Local\Temp\4d243021e90bd0418987cd20ea88f440N.exe
"C:\Users\Admin\AppData\Local\Temp\4d243021e90bd0418987cd20ea88f440N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C echo 'OS{8e2fdb6ba0383ad85d0937bbb7f21186}'
  2⤵
  PID:3480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads