a02b9ce9695dcf224e04b683973559c18aa3a6df8154c38646c5abee8d074e6b | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-11-2022 06:57

Sharing

Report Analysis Logs

General

Target

run.bat
Size

52B
MD5

9b87a485cf8ab6c0d551bc4eb29f908c
SHA1

03d57d461cd941a5a48e3caba5c56fa0f5c6ebde
SHA256

d6f5a35673fc49905ac7d8b2b8be4303b9a6386c441fd9571df661299f398071
SHA512

aea184ee1986f2ffbf8e1ef18c53ffb944968520d90c0377bcc853cf450aae456d713a623f2a87b8a7a0b20db414a9d5e25d4bb761ee05ae2f55003f4008d5bb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 804	1280	cmd.exe	29
PID 1280 wrote to memory of 804	1280	cmd.exe	29
PID 1280 wrote to memory of 804	1280	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sample.dll,YhrFH91
  2⤵
  PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads