a00e50939f9bcf650f070875ba5b8ae5c34b04516a45e1e112566b316753d332 | Triage

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
resource tags

arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system
submitted
15-07-2022 15:42

Sharing

Report Analysis Logs

General

Target

cmd.bat
Size

192B
MD5

966d235cf7f9966972c8c9325216bdc9
SHA1

b50704c9a0ef70637a9c0ab8144595a010e445a9
SHA256

b8025c914752b5ed8db55b595521ba7c15d93d3c6fcd9e3476b17b228c075d8c
SHA512

8f8be6bcdf23dd56915d4fedcea633f5d58d05c7633cd2620edfbceb605c29e92e0219c0d5089ed93823e35998137bebdc9c84bce304f153ac46b7feff1fee35

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1976 wrote to memory of 940	1976	cmd.exe	rundll32.exe
PID 1976 wrote to memory of 940	1976	cmd.exe	rundll32.exe
PID 1976 wrote to memory of 940	1976	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\receive-64.dat,DllMain --ma="license.dat"
2⤵
PID:940

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-54-0x0000000000000000-mapping.dmp

Download