23f7d8a6ca41d447cb9c1732dfe9735f88c572b1f26c7c2437dd5345a948f215 | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 01:04

Sharing

Report Analysis Logs

General

Target

inexhaustive/german.cmd
Size

323B
MD5

4e9ca6829429565996e5353dfc01cdbe
SHA1

38850389bc765c15fdf99bcb3b68d60a6c6873c2
SHA256

3067d0ab77781053f17efa2d857ada09e41ca4caa89feae5f05253680e4eba51
SHA512

76a7da29e1a3a9bb2d10053e950b81592715f5ac2aeefe5279027d91e86bdf8f89c91ba56f43fa7e4acd61a20856e20c54f9b99d889b6df36f5c48bfc45acf6c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2020 wrote to memory of 1016	2020	cmd.exe	replace.exe
PID 2020 wrote to memory of 1016	2020	cmd.exe	replace.exe
PID 2020 wrote to memory of 1016	2020	cmd.exe	replace.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\inexhaustive\german.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\system32\replace.exe
replace C:\Windows\\system32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:1016

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-54-0x0000000000000000-mapping.dmp

Download