5304522c3f48984337f18133639815cab62f24ef25407c3a097fcecfc4b4ed9f | Triage

Analysis

max time kernel
90s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 08:28

Sharing

Report Analysis Logs

General

Target

reviewer/ungroomed.cmd
Size

354B
MD5

6d1154c490214c6ca6a9186cc7a7a04e
SHA1

697909602a5f9a0f9bf6098806a9411d8d84de71
SHA256

67799a42b9d4dd9cbdab2bfb34b91aab636922f84b24b8a6374b8ad20fb10c19
SHA512

184966728fbaee9d8591f6fe8516af8b9fe99183442115a533ce6f5c1477cb3817da799c7da10bbb3212fd07fcc6ea75698fea0776fb5bf75043e212d87a8564

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 5096	3128	cmd.exe	82
PID 3128 wrote to memory of 5096	3128	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\reviewer\ungroomed.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\system32\replace.exe
  replace C:\Windows\\system32\\regs C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:5096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads