9d8879758ebe0c5d8f02881ab8202a970ea004271913f1f3047d57ecd79e708e | Triage

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

disallowable/guam.cmd
Size

387B
MD5

3018ed5a9d6a43e1910a3219c93fb409
SHA1

31dec26fd423717acb681d1503c2cb2fe5a33053
SHA256

54c1cfd1aa8050d4d542f5ce7e893076f1eed2c5b35cfdfc55f0a595724bc9ad
SHA512

21efd2fbe75727228a9a32138ed1c2310a932919edad6a881607b62b79bab539afe7b06a526cb14691baa4d05dc453ff7fcdaf0a51222aba279eeb27cede0696

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4500	4616	cmd.exe	83
PID 4616 wrote to memory of 4500	4616	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\disallowable\guam.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\system32\replace.exe
  replace C:\Windows\system32\regsv C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads