1379fd67588484b8817a50e5fdfb37ced156e44b3a4f0fdd466409e481733ef5 | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:40

Sharing

Report Analysis Logs

General

Target

ʹ֮/ֶɾ.bat
Size

20B
MD5

2c46a2848d67aaaea8b606fd29ea8792
SHA1

9df6b24a7e38aceca70bce2824d60e4beda89329
SHA256

d330af5b7a6657228149926f857c36d9f74c111a4e264f469381b6c8a437dbe3
SHA512

49ae52a8e1b99096831641d9e519268ad996b5eabfb3e649466c6c5459a2f6956bd9f9d231edb4e7dd66f4757aa3ae8774e4fb27f62742af2a9bfd381095ed90

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exeregsvr32.exe

description	pid	process	target process
PID 3884 wrote to memory of 1756	3884	cmd.exe	regsvr32.exe
PID 3884 wrote to memory of 1756	3884	cmd.exe	regsvr32.exe
PID 1756 wrote to memory of 2040	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 2040	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 2040	1756	regsvr32.exe	regsvr32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ʹ֮\ֶɾ.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\system32\regsvr32.exe
  regsvr32 test.dll /u
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\regsvr32.exe
    test.dll /u
    3⤵
    PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-132-0x0000000000000000-mapping.dmp

Download
memory/2040-133-0x0000000000000000-mapping.dmp

Download
memory/2040-134-0x0000000010000000-0x0000000010176000-memory.dmp

Filesize
1.5MB

Download