6b237e67caa3dfcdefab60fc74c94a703724704b237486b8234823dcb3eb4c15 | Triage

Analysis

max time kernel
11s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 15:29

Sharing

Report Analysis Logs

General

Target

BwPaidTempSpafer.exe
Size

79.5MB
MD5

e981b80ae9f24d5ef87dc9aac1c44f7d
SHA1

35e4467695c7ebd30d9ec824563fce97354f5dfa
SHA256

6b237e67caa3dfcdefab60fc74c94a703724704b237486b8234823dcb3eb4c15
SHA512

840351727fd1f486e252ddecc2c4916e8effc1a442a5b33d63c154964049a497a877ee08fec9c0d1d85a8c97310dcc201317513eef1d64146c2c72d6fc18d7d5
SSDEEP

1572864:rxwcLB97ySZC0dCbOJzHTFY9H6AsP2q/gtUbR1DQchW:rKYByACbkm9HG5zDl

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4876	BwPaidTempSpafer.exe
4876	BwPaidTempSpafer.exe
4876	BwPaidTempSpafer.exe
4876	BwPaidTempSpafer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4176	4876	BwPaidTempSpafer.exe	92
PID 4876 wrote to memory of 4176	4876	BwPaidTempSpafer.exe	92

C:\Users\Admin\AppData\Local\Temp\BwPaidTempSpafer.exe
"C:\Users\Admin\AppData\Local\Temp\BwPaidTempSpafer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Text does not contain our data > DumpErr
  2⤵
  PID:4176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-0-0x00007FFA59B90000-0x00007FFA59B92000-memory.dmp

Filesize
8KB

Download
memory/4876-1-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download