0c379e7f59e89605eb70890dfeeb564ac64461fc8911031f15cbf5c4ace639e5 | Triage

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 17:45

Sharing

Report Analysis Logs

General

Target

document_3_Oct31.iso.contents/ribfaymasnot/chickenrelaxed.bat
Size

1KB
MD5

828b1399a4a4ed0982be3def3ac1b9ca
SHA1

5929cbf6381665b40207e11c009aefae2d215cb1
SHA256

0d64fb2cd5cce8f8e8a9ac1c311d1867ec1dadb7622a3bc5e930d1c7063ae62e
SHA512

ba142ad12943295363436b2881089318a104a0b5e18c7fffbc52301aa2b5486ad026dadee86f0a242fa19e59d706402557be4d4a48a1f9e2f1dccfcd3bc88833

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4904 wrote to memory of 4892 4904 cmd.exe xcopy.exe
PID 4904 wrote to memory of 4892 4904 cmd.exe xcopy.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\document_3_Oct31.iso.contents\ribfaymasnot\chickenrelaxed.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\system32\xcopy.exe
xcopy /s /i /e /h ribfaymasnot\shortening.dat C:\Users\Admin\AppData\Local\Temp\*
2⤵
PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4892-132-0x0000000000000000-mapping.dmp

Download