f3f0f6e0193c215323d1b0ace60c6bb0befd07251b91ad8497473f426aadae4c | Triage

Analysis

max time kernel
125s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 05:00

Sharing

Report Analysis Logs

General

Target

100%游戏存档/双击我改签v0.5.exe
Size

37KB
MD5

d7c6e7d592db6f4766f360098c1a3edd
SHA1

48457312af8c5398cb36272044e0707edd82776c
SHA256

237405750ab7d78c1db9f51d4eae7a4a46147bf064a9be61de41fe8aa91ca581
SHA512

1e9b2bb79ad73297becdbed2cb35fe5f08932bb144c54e7469bde50a891e0f973b8d173d8a44c38f56cdd043d31b982eb4a901e01b9d845906ba9f2aa170b122
SSDEEP

768:GnN9dODsbW1WechF6g7K2hnxQhjLzPaKmhznlEIJ3TUuV:G7omW1shg9aQKnLU8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4444	4484	双击我改签v0.5.exe	90
PID 4484 wrote to memory of 4444	4484	双击我改签v0.5.exe	90

C:\Users\Admin\AppData\Local\Temp\100%游戏存档\双击我改签v0.5.exe
"C:\Users\Admin\AppData\Local\Temp\100%游戏存档\双击我改签v0.5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4116,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
1⤵
PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads