Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/07/2026, 17:45
General
- Target exiftool-13.59_64/exiftool(-k).exe
- Size 57KB
- Sample260705-wb8ecsat4k
- SHA256 68c079c32fdae0d6c7130e9a5fb73f8ac9dabdf9ab8da312da4f6c549d6d3385
Score
1/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\exiftool-13.59_64\exiftool(-k).exe"C:\Users\Admin\AppData\Local\Temp\exiftool-13.59_64\exiftool(-k).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /x/d/c "more < "C:\Users\Admin\AppData\Local\Temp\exiftool-13.59_64\exiftool_files\windows_exiftool.txt""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\more.commore3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3264-0-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3264-10-0x0000000067B00000-0x0000000067B1A000-memory.dmp
memory/3264-9-0x0000000066200000-0x000000006620F000-memory.dmp
memory/3264-8-0x0000000064BC0000-0x0000000064BCF000-memory.dmp
memory/3264-7-0x0000000061D00000-0x0000000061D10000-memory.dmp
memory/3264-6-0x0000000063DC0000-0x0000000063DD7000-memory.dmp
memory/3264-5-0x0000000061A40000-0x0000000061A50000-memory.dmp
memory/3264-4-0x000000006FC40000-0x000000006FDA4000-memory.dmp
memory/3264-3-0x0000000064940000-0x0000000064955000-memory.dmp
memory/3264-2-0x0000000061440000-0x000000006145A000-memory.dmp
memory/3264-1-0x0000000065780000-0x0000000065AD2000-memory.dmp