19ffefca0054a6fccff7721f57e711e881a3ecfde650a7258cf89b5f3c5e95af | Triage

Analysis

max time kernel
3s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
04-11-2020 18:16

Sharing

Report Analysis Logs

General

Target

spr.bat
Size

86B
MD5

d3061ed8a1faea8327150f4d3f523b70
SHA1

0b11c2073bddce442fcb72a459667173ca2cbb28
SHA256

3b48a7dab6a2ddd45687883da733189b3b6fe271a6d822a1f8ac56a52ee933fd
SHA512

4638f0b8b14005b1005c36d8d14721f3459d2529fae36a5a1d77cb4b4e2d3f7a2d778d92fd1cc5aa954bfc992233bd6a79b49c866fbd0b98948bfee6f93305cc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1852 wrote to memory of 1192	1852	cmd.exe	rundll32.exe
PID 1852 wrote to memory of 1192	1852	cmd.exe	rundll32.exe
PID 1852 wrote to memory of 1192	1852	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\spr.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\system32\rundll32.exe
rundll32.exe "\\SRV01QW\sp\b.dll",DllRegisterServer --append="carraro" --multiproc
2⤵
PID:1192

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-0-0x0000000000000000-mapping.dmp

Download