2b071652ac3988a702dd2db58cda4c822ac1bd50043ad9fd44a57adadf0f4b8c | Triage

Analysis

max time kernel
108s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 05:08

Sharing

Report Analysis Logs

General

Target

goodbyedpi-0.2.2/2_any_country.cmd
Size

204B
MD5

2e479250a2d20c6d2d5fc5171528694b
SHA1

e72055aaabf6ae076d45bc6ade3a9aa8c8da33c3
SHA256

8f432fb6710d0d2d36d89ab4125157766722928afe2e70077cd921f27579ad5a
SHA512

7550871629ce9f72a72fb9e2b17093505c036737cfd0e21722ae9eaad4c8ed99916937c3e73637af63a1d24e392863fe79c6606dc29afc31129fcd6bfb71d67e

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5660 wrote to memory of 184	5660	cmd.exe	88
PID 5660 wrote to memory of 184	5660	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\2_any_country.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5660
- C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5
  2⤵
  PID:184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/184-0-0x00007FF77EBA0000-0x00007FF77EBBB000-memory.dmp

Filesize
108KB

Download
memory/184-1-0x0000000062800000-0x000000006280D000-memory.dmp

Filesize
52KB

Download
memory/184-2-0x00007FF77EBA0000-0x00007FF77EBBB000-memory.dmp

Filesize
108KB

Download