c6021e59df4ef15a6590e4cc4b5d2a75c7c881397f154163849f969ebfbf8933 | Triage

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04-06-2022 13:09

Sharing

Report Analysis Logs

General

Target

reconstructed_core/2022-06-04/core/cmd.bat
Size

188B
MD5

d67f758395e66ed03d9065d8c23f2894
SHA1

1d635b99201ef4551132d29495e0c259404bd5eb
SHA256

afc903fcce880470df94d38d1f877c114c16ba78d2a25a0b9094c99e425f3586
SHA512

d48a6f81dc69bf0b9024e775c8620c504f1563e57978213635e3ebd546c450a3e8c621ba58d1dc1d1c2f71b4563ff8c7abd0915255874a59bfb4917c2cb2ff5f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4176 wrote to memory of 4916 4176 cmd.exe rundll32.exe
PID 4176 wrote to memory of 4916 4176 cmd.exe rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\reconstructed_core\2022-06-04\core\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4176

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\labor-.tmp,DllMain --ma="license.dat"
2⤵
PID:4916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4916-130-0x0000000000000000-mapping.dmp

Download