ba035e7c463c8d7bb7b1c48e2822996c3982423291025e10fcbbc07f36b12e7a | Triage™

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25/07/2022, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cmd.bat
Size 187B
Sample220725-sh1fjsbec3
SHA256 fe3b5c3ef31d8a305692bb155c42a8f70a75165ca5d9beaf778dd3d3c519fe84
MD5 da1b98535c3921a331f32a649b27c6c6
SHA1 00cf0c62f4128e56f3503bc7522ae053e616b1bc
SHA512 0ffe58b5dad5d22220cdf63424dd84bfa91264bf824669da1a3d0c7aa0360ba6417b2b4a4076b673c2dc09a2c95adc005a86a7d70af6cce65ec2ab1e6e884bf7
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1064	1636	cmd.exe	15
PID 1636 wrote to memory of 1064	1636	cmd.exe	15
PID 1636 wrote to memory of 1064	1636	cmd.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\minute_x64.dat,#1 --be="license.dat"
1⤵
PID:1064

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads