6a8619c9bb43784de4c77b858ba0f8ea7d51438c9831c60a25a72728c3148aad | Triage™

Analysis

max time kernel
102s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
disallowable/expiated.cmd
Size 347B
Sample221028-dd39baeda8
SHA256 f1afcef0c6618cd4bd0889b1844a89ea0d259c4e292f8e109ea17405e56b5a39
MD5 c130cc03a0c0b1d4c9284c236fefbc25
SHA1 0dee60c3a561ee60af3d5646a7a19829b8e59b48
SHA512 30227607f37cf8d6201505018a48438fe1a33832714a8405e241f98e6070b3d13a49ee07f11234fc39e55d239a23c622cfd30f68395489d0099d873cdc1fece8
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4960	3892	cmd.exe	85
PID 3892 wrote to memory of 4960	3892	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\disallowable\expiated.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\system32\replace.exe
  replace C:\Windows\system32\regsv C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads