1379fd67588484b8817a50e5fdfb37ced156e44b3a4f0fdd466409e481733ef5 | Triage

Analysis

max time kernel
46s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:40

Sharing

Report Analysis Logs

General

Target

ʹ֮/ֶɾ.bat
Size

20B
MD5

2c46a2848d67aaaea8b606fd29ea8792
SHA1

9df6b24a7e38aceca70bce2824d60e4beda89329
SHA256

d330af5b7a6657228149926f857c36d9f74c111a4e264f469381b6c8a437dbe3
SHA512

49ae52a8e1b99096831641d9e519268ad996b5eabfb3e649466c6c5459a2f6956bd9f9d231edb4e7dd66f4757aa3ae8774e4fb27f62742af2a9bfd381095ed90

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

regsvr32.exe

pid process

1176 regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.exeregsvr32.exe

description	pid	process	target process
PID 1696 wrote to memory of 1176	1696	cmd.exe	regsvr32.exe
PID 1696 wrote to memory of 1176	1696	cmd.exe	regsvr32.exe
PID 1696 wrote to memory of 1176	1696	cmd.exe	regsvr32.exe
PID 1696 wrote to memory of 1176	1696	cmd.exe	regsvr32.exe
PID 1696 wrote to memory of 1176	1696	cmd.exe	regsvr32.exe
PID 1176 wrote to memory of 1540	1176	regsvr32.exe	regsvr32.exe
PID 1176 wrote to memory of 1540	1176	regsvr32.exe	regsvr32.exe
PID 1176 wrote to memory of 1540	1176	regsvr32.exe	regsvr32.exe
PID 1176 wrote to memory of 1540	1176	regsvr32.exe	regsvr32.exe
PID 1176 wrote to memory of 1540	1176	regsvr32.exe	regsvr32.exe
PID 1176 wrote to memory of 1540	1176	regsvr32.exe	regsvr32.exe
PID 1176 wrote to memory of 1540	1176	regsvr32.exe	regsvr32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ʹ֮\ֶɾ.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\regsvr32.exe
  regsvr32 test.dll /u
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\regsvr32.exe
    test.dll /u
    3⤵
    PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-54-0x0000000000000000-mapping.dmp

Download
memory/1176-55-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/1540-56-0x0000000000000000-mapping.dmp

Download
memory/1540-57-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1540-58-0x0000000010000000-0x0000000010176000-memory.dmp

Filesize
1.5MB

Download