b9af69ac821a649f211c99e3edf32a76a213e9450b5e972a6cdda5758af530dd | Triage

Resubmissions

23/08/2024, 16:00

240823-tf47dsteqe 6

23/08/2024, 15:32

240823-sy293sseld 4

23/08/2024, 15:18

240823-sp1d5athqk 8

23/08/2024, 14:12

240823-rjcv7sydnd 7

23/08/2024, 02:33

240823-c17dta1cpd 7

23/08/2024, 02:11

240823-cmbpzszelg 4

23/08/2024, 02:00

240823-ce59mazbnh 4

23/08/2024, 01:37

240823-b1992a1dmm 5

23/08/2024, 01:24

240823-bsm5jazhpp 5

23/08/2024, 00:51

240823-a7p21awhld 6

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 02:00

Sharing

Report Analysis Logs

General

Target

net.exe
Size

80KB
MD5

bb1ae49b6b7c53499e94613761a6ac56
SHA1

76866dde54ee3fa5bc8efefb9d44e6bf859973aa
SHA256

afbe51517092256504f797f6a5abc02515a09d603e8c046ae31d7d7855568e91
SHA512

03e832e859915c3f17eec4205863383f23532892f69519fe604c15fcc855804608adabd0dbbda158307d9c009f88482633b24cb35c4ea85b7022fb638f6fc018
SSDEEP

1536:q++ViCmfVsRS+dFyRuyRaWqxkfDdR1dDNATmZF+:P+ViKnKfDD7DNATma

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 2592	208	net.exe	88
PID 208 wrote to memory of 2592	208	net.exe	88

C:\Users\Admin\AppData\Local\Temp\net.exe
"C:\Users\Admin\AppData\Local\Temp\net.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1
  2⤵
  PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads