953304fef02d0386e6379b0262f4b5d02c36c23fdfc02dbe0eb0e5fc578a5e59

Analysis

max time kernel
298s
max time network
290s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d440f.cmd
Size 295B
Sample261023-efdbcahv6x
SHA256 953304fef02d0386e6379b0262f4b5d02c36c23fdfc02dbe0eb0e5fc578a5e59
MD5 51eadc27475cf54054a875725c8246e2
SHA1 5663f9952898ea2c822850d7dcfd3f0b96b91a48
SHA512 d613cac0c02d1d3ae1f58e53072eed4933b1c789e5be4e5f20ed53e1e0c00b850f93653688508237898687e1ba8f3f48f75327de0a6448c7838ffe97a0b4f8f2
TLSH
T1BCE012CA258F203DD8F805897616B6D6B68A92A7B3C9F7D8314D0566448FE15C5C9F02
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2940	DocumentViewer.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
884	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 2940	884	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d440f.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Invoice\DocumentViewer.exe
  "C:\Users\Admin\AppData\Local\Invoice\DocumentViewer.exe"
  2⤵
  - Executes dropped EXE
  PID:2940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DocumentViewer.exe

Path C:\Users\Admin\AppData\Local\Invoice\DocumentViewer.exe
Size 60KB
SHA256 ff6d46571ab235df9b818b07b08057da61f3e4769b14f666dcf2b026665948da
MD5 bf0cd26158a2799089a4bbc97129528e
SHA1 af1f6b16d344842aa5f1323ba2aff367a8210c10
SHA512 301cbf32f1a92a1cb329c4efa2e97cf3c006fbbcca82cf7ce9e2f1588570dbb9a479bd11d1b4c6a73d116672bdad4f4568473cc799f050f625ea0394b22cf431
SSDEEP 768:787FL48sgkdLQiK+t3SJttrNF5b7Ps2iV2+8:A5SgkaS3WTs2iV8
TLSH
T16D5372E57ED95CC6ED20633C66EAC221373DFAE08A434B47E52026311B13FD16ED9296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2940-5-0x00007FF702FC0000-0x00007FF702FD6000-memory.dmp

Download