727d1e42275c605e0f04aba98095c38a8e1e46def453cdffce42869428aa6743 | Triage

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 10:12

Sharing

Report Analysis Logs

General

Target

nssm-2.24/src/version.cmd
Size

1KB
MD5

3e67b67b2ecb2d3042dfaa7d216883b1
SHA1

1e857c1fac7a99a8d280e219e9a8f1bd4d315a5d
SHA256

15b426e1c03c0976c9b133f82553da5c7e9cf3320dbb3b5cf269854afc80b548
SHA512

6482ee84a35462f38468cf3d4e31841524d4ad4b1bae9ac24df6f24c74676a8fe8c3999461698ec4e29bcfc57c9e1348795454edc9d95380c020dfdd5ba71407

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2172	412	cmd.exe	83
PID 412 wrote to memory of 2172	412	cmd.exe	83
PID 412 wrote to memory of 4736	412	cmd.exe	84
PID 412 wrote to memory of 4736	412	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nssm-2.24\src\version.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c git describe --tags --long
  2⤵
  PID:2172
- C:\Windows\system32\fc.exe
  fc version.h version.h.new
  2⤵
  PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads