fb029e39bbf3947d7931be4dcc28a02050c878d2e8f34534c49587259f191f00 | Triage™

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25/07/2022, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cmd.bat
Size 186B
Sample220725-vd25pabbbr
SHA256 52c0668bcfb04f64e27200554413f0e8b46f24782bfbbf61ef202d7a45577010
MD5 31a5126fa2f08ad99c65545649e9e40f
SHA1 2bdb65324cf44411ae837c7782a8d7a3efb5d3cf
SHA512 46ee74cd9b7849b15fb3f6119e27f819bb944d49867cca4dc1d738d16cf36895a403300c2b937c5ff99d80e829d38a496506705e30612468ce262b11df352504
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 960	1968	cmd.exe	28
PID 1968 wrote to memory of 960	1968	cmd.exe	28
PID 1968 wrote to memory of 960	1968	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\teach-x64.dat,#1 --be="license.dat"
  2⤵
  PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads