202d5e0b08a0ad5d5e6833d1f45ec8c403d67e85b5509dbf0763c262a1572522 | Triage

Analysis

max time kernel
15s
max time network
18s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
27/10/2022, 15:26

Sharing

Report Analysis Logs

General

Target

alphabetical/minds.cmd
Size

336B
MD5

06736c0d660316000d7be740e8e4f697
SHA1

b5d9ebb8c45e073cab006f763bdcd6fb8e7c10ab
SHA256

a9429c7dcf577e0974eb8ab8653cd6044eb7938d8d5e2b87a39584ac31b2025d
SHA512

de4ee253b9a822d739ef69989f77fc366ff5932bab584b069af1a1855c2128c49785ad6fd82a118b8d39ca47a06e0a09ae9a8b8bafb6c81b68ad02d30e3666d8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 4444	1016	cmd.exe	67
PID 1016 wrote to memory of 4444	1016	cmd.exe	67

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\alphabetical\minds.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\system32\replace.exe
  replace C:\Windows\\system32\\regs C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:4444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads