9dd98d9003151d92d8b5d39b135a51a0e4ca8e2ad43e6cffc666c2c6dc8570e9 | Triage

Analysis

max time kernel
75s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 19:54

Sharing

Report Analysis Logs

General

Target

Invoice-trappings_adv-82894_ISO/cabjawbitsly/wastingworship.bat
Size

1KB
MD5

1a671814b904c65f53ff5387809e3dcd
SHA1

51350700c96692350fa617fdadd86c3baca71235
SHA256

549c27abc5ce277069a10219eac6c7550926041a678a8d54fc8c55fd7cc7de10
SHA512

03b24d14e495df2db27bd2d8e7c80da007cbb8c2b1a7e13ba4829d6cb6eac68a338c6f72f363b3f90a194f82893bb204b5eeaadcfe336fbefc4bb1dee3571d4a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 3672	1716	cmd.exe	85
PID 1716 wrote to memory of 3672	1716	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Invoice-trappings_adv-82894_ISO\cabjawbitsly\wastingworship.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\xcopy.exe
  xcopy /s /i /e /h cabjawbitsly\fellowshipping.dat C:\Users\Admin\AppData\Local\Temp\*
  2⤵
  PID:3672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads