d5bed7d392dc8bd6c45f155f1f31a09e1e99f246b697a1fb98d5a63f96e91cf1 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-11-2022 20:56

Sharing

Report Analysis Logs

General

Target

cmd.bat
Size

189B
MD5

1b0986e0636ea647760dc3e6394782cb
SHA1

373f569810d64f0a4f0e2c4d1200f39bf3340506
SHA256

b6f3d79daa57782bef6b337fd83044a2c3010186173101a6dae6f6d6440ac695
SHA512

e6205459924516a4bad8f0f0c970c85dfc8334eff15df876eb28cf27787509307343d0ebf8b6827a815ef57d0a8bba2c549cb6aa568c8d86dac86390cbcc99f5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1896 wrote to memory of 2032	1896	cmd.exe	rundll32.exe
PID 1896 wrote to memory of 2032	1896	cmd.exe	rundll32.exe
PID 1896 wrote to memory of 2032	1896	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\height_x32.dat,#1 --tidu="license.dat"
2⤵
PID:2032

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-54-0x0000000000000000-mapping.dmp

Download