4b4824c1efdfdc0d1b163fbfa5925292849d1cc9cdb9f7e514c5d02235dda08e | Triage

Resubmissions

22-02-2022 16:14

220222-tpmzgacabp 10

13-12-2021 19:31

211213-x8wx9sfccm 10

Analysis

max time kernel
82s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
22-02-2022 16:14

Sharing

Report Analysis Logs

General

Target

core.bat
Size

186B
MD5

2e8904456778492446e7a344f08da03a
SHA1

19fde2da674f8f4c7314efaf3e7c158100861e31
SHA256

87eddf6b25dcd05c70fa7a348bfd1603dc812a82cd67095c78ccf6240be8f73c
SHA512

f05fe57f84898c38bcae76533e0123fa5911370228a46f49ad2cc36de0881488856e0fc361749b3b84ac89de63b1c6dae0c6c4813a83ddcca7320743588084b5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2504 wrote to memory of 744 2504 cmd.exe rundll32.exe
PID 2504 wrote to memory of 744 2504 cmd.exe rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\impose-32.tmp,DllMain /i="license.dat"
2⤵
PID:744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads