2b071652ac3988a702dd2db58cda4c822ac1bd50043ad9fd44a57adadf0f4b8c | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
26/03/2025, 05:08

Sharing

Report Analysis Logs

General

Target

goodbyedpi-0.2.2/2_any_country.cmd
Size

204B
MD5

2e479250a2d20c6d2d5fc5171528694b
SHA1

e72055aaabf6ae076d45bc6ade3a9aa8c8da33c3
SHA256

8f432fb6710d0d2d36d89ab4125157766722928afe2e70077cd921f27579ad5a
SHA512

7550871629ce9f72a72fb9e2b17093505c036737cfd0e21722ae9eaad4c8ed99916937c3e73637af63a1d24e392863fe79c6606dc29afc31129fcd6bfb71d67e

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1416	2040	cmd.exe	31
PID 2040 wrote to memory of 1416	2040	cmd.exe	31
PID 2040 wrote to memory of 1416	2040	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\2_any_country.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5
  2⤵
  PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-1-0x0000000062800000-0x000000006280D000-memory.dmp

Filesize
52KB

Download
memory/1416-0-0x000000013F8A0000-0x000000013F8BB000-memory.dmp

Filesize
108KB

Download
memory/1416-4-0x000000013F8A0000-0x000000013F8BB000-memory.dmp

Filesize
108KB

Download