ebad5fa29ebd4e05d54f6483f1445c421cc8d5577f6eb3821f11c94e9a07da09 | Triage

Analysis

max time kernel
96s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-07-2022 21:54

Sharing

Report Analysis Logs

General

Target

cmd.bat
Size

193B
MD5

3ab361d7b51fddd7960c2d64d28d46e1
SHA1

dbcf599550d5905059d327514de60c127d5ffef4
SHA256

44669ee8730255483c81532bb329a606549f3ac4eba92be1a755cb95868e6cb7
SHA512

c2627aa3bffbf1abf0ffc66771e40b5c38199b0762caf83fe15eb0aa3d6c47c977b569324605d5c85334b478c123b35fc1b7cb56a3dd530db00a5e86649edfcd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4080 wrote to memory of 3896 4080 cmd.exe rundll32.exe
PID 4080 wrote to memory of 3896 4080 cmd.exe rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\ordinary_64.tmp,DllMain --ma="license.dat"
2⤵
PID:3896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3896-130-0x0000000000000000-mapping.dmp

Download