4d17d739f32bb61e52d6f343b1ba81d1c5eb9c804a8f568a286f42da8f62d7f2 | Triage™

Analysis

max time kernel
156s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2022, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAT/AWESOME.cmd
Size 121B
Sample220825-nnvd9sdcf2
SHA256 9b9a5b560e5a70db8aba3cad39502b2d4e62c212e61ccc60e8429db4be614345
MD5 013cad81b749fd850aa4b412ece91a93
SHA1 f89d3f77286f8b5eb89efc699817b554938b10d3
SHA512 2954e00f352117b8df8e85c6e0475cae83ff146c4288ba6dd5c055cb860f054a1a90b96c48dd1d99d22d7bd6f7ccfd5b8193ae378eac3035fa39580b1d81640b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 4964	2620	cmd.exe	83
PID 2620 wrote to memory of 4964	2620	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAT\AWESOME.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\system32\rundll32.exe
  rundll32 MAT\PPM.DAT, #1
  2⤵
  PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads