09d55f469c9ecb5e7ee791e4bb95cf6fc44cf42a32f6bd8153f38232670e658a | Triage

Analysis

max time kernel
83s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2022 10:09

Sharing

Report Analysis Logs

General

Target

belts/acknowledgments.cmd
Size

313B
MD5

d7acb54f7d76754ce046b8fa43938ec3
SHA1

d9ff818e1a3a0b94a100066b8a1a54fa88662698
SHA256

eea650caf415c1ec98301c81e01730dbc90933b673f2ece8852089cf53c45755
SHA512

3508923ab2acd4169b9a68bda4b6b4a6566649826eaeb0b5ec5e73a45f38f6a6261a32a79ce9ce8af47d3154847defe73f19ab01029fc2683e79e778bd8a80c6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 388 wrote to memory of 4900 388 cmd.exe replace.exe
PID 388 wrote to memory of 4900 388 cmd.exe replace.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\belts\acknowledgments.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\l32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4900-133-0x0000000000000000-mapping.dmp

Download