5304522c3f48984337f18133639815cab62f24ef25407c3a097fcecfc4b4ed9f | Triage

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 08:28

Sharing

Report Analysis Logs

General

Target

reviewer/ungroomed.cmd
Size

354B
MD5

6d1154c490214c6ca6a9186cc7a7a04e
SHA1

697909602a5f9a0f9bf6098806a9411d8d84de71
SHA256

67799a42b9d4dd9cbdab2bfb34b91aab636922f84b24b8a6374b8ad20fb10c19
SHA512

184966728fbaee9d8591f6fe8516af8b9fe99183442115a533ce6f5c1477cb3817da799c7da10bbb3212fd07fcc6ea75698fea0776fb5bf75043e212d87a8564

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 940	904	cmd.exe	28
PID 904 wrote to memory of 940	904	cmd.exe	28
PID 904 wrote to memory of 940	904	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\reviewer\ungroomed.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\system32\replace.exe
  replace C:\Windows\\system32\\regs C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads