bb916759ec1184381be7b01ae757befdfd578d56fe356a2f77ac71420b150859 | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14-07-2022 16:16

Sharing

Report Analysis Logs

General

Target

cmd.bat
Size

191B
MD5

9d16a11a95ee4d4cc5fbb5cc0d7f4279
SHA1

5b99b90a57addc4024313741f20c527d4be19b33
SHA256

ae69c01458a71817de60f091be4bd669aaec5001b010dde02aa8d4cab83ea41b
SHA512

987fb4096c0a7defc82ceeb592f31f226dcbae8af333e4f8a0afd35e4e24ea54c8a69e60aeb2abe07d6d4ae0dd3c95358756199f2135a1a72e5876c8d3a842ed

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1208 wrote to memory of 4820 1208 cmd.exe rundll32.exe
PID 1208 wrote to memory of 4820 1208 cmd.exe rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\divert_32.tmp,DllMain --ma="license.dat"
2⤵
PID:4820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4820-130-0x0000000000000000-mapping.dmp

Download