45665741a90336de07eee401dd9c160589b42df04d22dbf2babe948940ebc74a | Triage

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-08-2022 17:14

Sharing

Report Analysis Logs

General

Target

cmd.bat
Size

186B
MD5

b161383c2aea311f67dc959269d5b0e8
SHA1

0c6ae11d558de1487c7641e0f32634ecba4ee4d7
SHA256

5719221c1480c443d942f5f9ab59b346d2194f7e2d69c693af05d0f55f3ac447
SHA512

39b2960a3aede6b031ddc279f5eb75aa6b2ed53042206d4a839c0a90c29754a25397e67aab46f301b6161fa11e2cc28e46c8349ddde4890e907bb3ba06896922

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1440 wrote to memory of 1480	1440	cmd.exe	rundll32.exe
PID 1440 wrote to memory of 1480	1440	cmd.exe	rundll32.exe
PID 1440 wrote to memory of 1480	1440	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\augustx32.dat,#1 --be="license.dat"
2⤵
PID:1480

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-54-0x0000000000000000-mapping.dmp

Download