ef0f0bd1e919ee96c7d20547f7a823218cd73452f36c47d1a22f2726d5d64308 | Triage™

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
phar.phar.bat
Size 43B
Sample260508-l8a51sfx2x
SHA256 ef0f0bd1e919ee96c7d20547f7a823218cd73452f36c47d1a22f2726d5d64308
MD5 9c8d6858fe19259b1be399080be8608f
SHA1 caa83d1d0aa6865e6a357aad820c45ee19ebdf8c
SHA512 9585e997a18f306dba6ee8f35dbfba17d4f782f613a65038db1bf1ca3d3ff4c2b58f4b41ce96153d12c4e2927f379f7fe590635f5812c9553e303a90aa25e220
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4892	4804	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\phar.phar.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\php.exe
  "C:\Users\Admin\AppData\Local\Temp\php.exe" "C:\Users\Admin\AppData\Local\Temp\pharcommand.phar"
  2⤵
  PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4892-1-0x0000026A448C0000-0x0000026A448C8000-memory.dmp

Download

memory/4892-0-0x0000026A44A10000-0x0000026A44AAB000-memory.dmp

Download