9eae7cd1f8f1ba817e3cbdfdaa4b52658c4339940c038ff3f199142de31b8915 | Triage™

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23/08/2022, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MANY/CASEY.cmd
Size 131B
Sample220823-19b62adee5
SHA256 7faed32e50b602847bb19c776104c39dcff42394fc608d2b0ca5bf58f6238068
MD5 e768a0617a0b8bcd9106294cb852f88d
SHA1 bdfd06d1a3ad8529615eeaa3421eb174ba5a9037
SHA512 051e419d48a35cd053a05946e239a5a591a7221df2980e664c2c8d4dfce10369fec647cea76f3ec087142fedad2ae794b22fedae40c988eaa8f88e7e961edef3
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1536	868	cmd.exe	28
PID 868 wrote to memory of 1536	868	cmd.exe	28
PID 868 wrote to memory of 1536	868	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\MANY\CASEY.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\system32\rundll32.exe
  rundll32 MANY\TRACTOR.DAT, #1
  2⤵
  PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads