ba035e7c463c8d7bb7b1c48e2822996c3982423291025e10fcbbc07f36b12e7a | Triage™

Analysis

max time kernel
121s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2022, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cmd.bat
Size 187B
Sample220725-sh1fjsbec3
SHA256 fe3b5c3ef31d8a305692bb155c42a8f70a75165ca5d9beaf778dd3d3c519fe84
MD5 da1b98535c3921a331f32a649b27c6c6
SHA1 00cf0c62f4128e56f3503bc7522ae053e616b1bc
SHA512 0ffe58b5dad5d22220cdf63424dd84bfa91264bf824669da1a3d0c7aa0360ba6417b2b4a4076b673c2dc09a2c95adc005a86a7d70af6cce65ec2ab1e6e884bf7
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 624	3992	cmd.exe	82
PID 3992 wrote to memory of 624	3992	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\minute_x64.dat,#1 --be="license.dat"
  2⤵
  PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads