428b46215b5c992fd7aa4d3e6edabce901928bad7231050eda6b1a64344e5854 | Triage

Analysis

max time kernel
366s
max time network
428s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
21/09/2022, 00:19

Sharing

Report Analysis Logs

General

Target

Run-DLL.bat
Size

34B
MD5

396374ee917bc1abedd996c8152a4454
SHA1

dd69c36489b15a4057d8cceef4b1ff3fad4f8a2a
SHA256

5663fcbbdbfdd1b78cee360919363009cdeaa58189ce5aec87d2014f02cc4001
SHA512

3a3e3e7015a9818741d0641538bf6b0f77066b206ebc0f8b76127386b79ab05993ebb9a35767f22bac02540ec6d6a686c8ed28c51706b4b4e7f9c7faa1012b5d

Score

5^/10

Malware Config

Signatures

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3776	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4988	3776	WerFault.exe	67

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3776	2648	cmd.exe	67
PID 2648 wrote to memory of 3776	2648	cmd.exe	67

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Run-DLL.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\rundll32.exe
  rundll32.exe nWysXc.bin,CreateTask
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:3776
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3776 -s 100
    3⤵
    - Program crash
    PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads