209fb2790547b9ccff40a9eed598ca587b0240e843b0bd1ec7424c5db2e3f672 | Triage

Analysis

max time kernel
91s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24-06-2022 17:19

Sharing

Report Analysis Logs

General

Target

cmd.bat
Size

191B
MD5

25bde4fb4fe8e8f50488ee87ef97db59
SHA1

ccf95a0b55524aa89c5426e56ba683b70ca9abcf
SHA256

c856a9209c268d4b405eb18c0396850f4d30f3cf72d94c4aa4db11e116209f12
SHA512

dd6423be13e57d0fcec58109c82732a1919fb945a762e9d79c36cd59d81d875b5051abcd7007a152fe959adc8efcd44820542148561fd13f5b497278fc2ae0b6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 3172 wrote to memory of 1416 3172 cmd.exe rundll32.exe
PID 3172 wrote to memory of 1416 3172 cmd.exe rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\sugar_x64.tmp,DllMain --ma="license.dat"
2⤵
PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-130-0x0000000000000000-mapping.dmp

Download