856f0423fe435cb444b4e130ea81baece49b4478a1c6362cca1cd9fe350bd17e | Triage

Analysis

max time kernel
62s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 18:27

Sharing

Report Analysis Logs

General

Target

reviewer/fearless.cmd
Size

378B
MD5

548faee98b25eab87e96aa27ef0bc669
SHA1

9d95a1ba9db3005e037f1900de9dc4fc0504d948
SHA256

69525bd04030347e3985e099f4f028e1c8323c245986b05d3d1cba2d8866ef95
SHA512

821fc57f2b74fb8ccb89d999442ad38d5d0fde6da94bd3a888709777305f89d613fd33b0f36bfdefde6ccf95d99a67a5f2f40c4fb87fb362506e8e26e53cd6a8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2240	1792	cmd.exe	83
PID 1792 wrote to memory of 2240	1792	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\reviewer\fearless.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\system32\replace.exe
  replace C:\Windows\\system32\\regs C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads