6a8619c9bb43784de4c77b858ba0f8ea7d51438c9831c60a25a72728c3148aad | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 02:54

Sharing

Report Analysis Logs

General

Target

disallowable/expiated.cmd
Size

347B
MD5

c130cc03a0c0b1d4c9284c236fefbc25
SHA1

0dee60c3a561ee60af3d5646a7a19829b8e59b48
SHA256

f1afcef0c6618cd4bd0889b1844a89ea0d259c4e292f8e109ea17405e56b5a39
SHA512

30227607f37cf8d6201505018a48438fe1a33832714a8405e241f98e6070b3d13a49ee07f11234fc39e55d239a23c622cfd30f68395489d0099d873cdc1fece8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1540	1672	cmd.exe	28
PID 1672 wrote to memory of 1540	1672	cmd.exe	28
PID 1672 wrote to memory of 1540	1672	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\disallowable\expiated.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\replace.exe
  replace C:\Windows\system32\regsv C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads