852d511a9276c1004efcdc148e70aecb973948389be1094cdbc850c4face77d6 | Triage

Resubmissions

17-03-2022 16:28

220317-tyt45schbr 1

02-03-2022 07:56

220302-js74psdhh5 10

24-02-2022 19:52

220224-ylj6maehbj 1

Analysis

max time kernel
4294181s
max time network
125s
platform
windows7_x64
resource
win7-20220223-en
submitted
24-02-2022 19:52

Sharing

Report Analysis Logs

General

Target

core.bat
Size

188B
MD5

5d557256208a36dcd239278ba626f30c
SHA1

1e54238d55ab57ab5e7b787d3f369d6a02374d2b
SHA256

26cfdedc156563695d6188240fa38ee5d3b29e468dee368facf66b8710eae3e2
SHA512

2cd8215e99f4d61035747670dd2109aa806fe4c505648982926bb1bd886eadf1da583823e019e8af34939531bf669b6ffb19a334f3c3e678c56a7f5ebe2745ad

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1232 wrote to memory of 732	1232	cmd.exe	rundll32.exe
PID 1232 wrote to memory of 732	1232	cmd.exe	rundll32.exe
PID 1232 wrote to memory of 732	1232	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pumpkin-32.tmp,DllMain /i="license.dat"
  2⤵
  PID:732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads