faf28fe3156457ed5d637722f1bf7d7b976d870cf87d30d48745267004f9cfee | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 18:22

Sharing

Report Analysis Logs

General

Target

dishutlacsix/embassywebsite.bat
Size

1KB
MD5

93180a5be2c552663f0899e8875a324e
SHA1

a005c59b7cc6f3ecc3cfe38a963d028a843bdd76
SHA256

21caefaff9b966c41d0b7f2589def908ef0312c197e1345ffadb8a71a8de3bee
SHA512

ab9844471bc3e2d3dc55e8458cfdea415b67dc9126dc99c19ad267bada8b66b29f90ebf8de67fd083091c0f7ac48cefb9838fbe060caad6fc1a1f81a1dc14b81

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 936	1900	cmd.exe	28
PID 1900 wrote to memory of 936	1900	cmd.exe	28
PID 1900 wrote to memory of 936	1900	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\dishutlacsix\embassywebsite.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\xcopy.exe
  xcopy /s /i /e /h dishutlacsix\overfulfilling.dat C:\Users\Admin\AppData\Local\Temp\*
  2⤵
  PID:936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-54-0x0000000000000000-mapping.dmp

Download