ae61277489a511da3c0ec4e8aae94c6b1205197b5bc3999cab880294ca0a3948 | Triage

Analysis

max time kernel
91s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-06-2022 16:21

Sharing

Report Analysis Logs

General

Target

cmd.bat
Size

190B
MD5

b112c1a5e2d658d89f7a767cd85322c5
SHA1

718ce431e17d4afbe33a688c22bfd56a870ed005
SHA256

461ef00d1700cf93f9dbac33be410a65c0b293ee732a571cf5652decb6816adb
SHA512

995e4bd9d6cd9cce7e9a66fc32e820c178e74d43de8f4050c9dd4cfd864113f8e62058b067ccf3ede0ed6f2082b2648a41a139c403675d56dc49732797452de3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4620 wrote to memory of 4660 4620 cmd.exe rundll32.exe
PID 4620 wrote to memory of 4660 4620 cmd.exe rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4620

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\dwarfx64.tmp,DllMain --ma="license.dat"
2⤵
PID:4660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4660-130-0x0000000000000000-mapping.dmp

Download