Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2022 00:03
Static task
static1
Behavioral task
behavioral1
Sample
beyond_x32.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
beyond_x32.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
cmd.bat
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
cmd.bat
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
cmd.bat
-
Size
187B
-
MD5
fcfd27ec4fb2d4f7d988b15da6cc02c8
-
SHA1
0aefd23617dda369f19b8264c2affd9a185eed97
-
SHA256
1aadfec2e8aa15429672f3f0cd7d6c68b85fe2b363025ee2c2fa57f07bc1c679
-
SHA512
cba889bcc22339d8388ba5cd1885a3408cad040dbf0a1d0711c922f8a445db0d4375e22a11be6e7a76ec63094dfa62d4108ab06fe14dcb861eba46f49cf34328
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 628 wrote to memory of 2068 628 cmd.exe rundll32.exe PID 628 wrote to memory of 2068 628 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\core\beyond_x32.tmp,#1 --be="license.dat"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2068-132-0x0000000000000000-mapping.dmp