4d17d739f32bb61e52d6f343b1ba81d1c5eb9c804a8f568a286f42da8f62d7f2 | Triage™

Analysis

max time kernel
31s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/08/2022, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAT/AWESOME.cmd
Size 121B
Sample220825-nnvd9sdcf2
SHA256 9b9a5b560e5a70db8aba3cad39502b2d4e62c212e61ccc60e8429db4be614345
MD5 013cad81b749fd850aa4b412ece91a93
SHA1 f89d3f77286f8b5eb89efc699817b554938b10d3
SHA512 2954e00f352117b8df8e85c6e0475cae83ff146c4288ba6dd5c055cb860f054a1a90b96c48dd1d99d22d7bd6f7ccfd5b8193ae378eac3035fa39580b1d81640b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1296	912	cmd.exe	28
PID 912 wrote to memory of 1296	912	cmd.exe	28
PID 912 wrote to memory of 1296	912	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\MAT\AWESOME.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\rundll32.exe
  rundll32 MAT\PPM.DAT, #1
  2⤵
  PID:1296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads