1379fd67588484b8817a50e5fdfb37ced156e44b3a4f0fdd466409e481733ef5 | Triage

Analysis

max time kernel
70s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:40

Sharing

Report Analysis Logs

General

Target

ʹ֮/ֶע.bat
Size

17B
MD5

024ae6ee0a93dc9298e272b75022908e
SHA1

d9fad8bad31c9a5a1c0a725ee5a9b2af021d2433
SHA256

38aa3d96459d6b7feb36e637564c4c75c1c1a2c186139dbb1c5e9600f95a81ce
SHA512

a642e0453281881b30c04d25d08366a5246d86582f481afa3bb28627aa8ef15745ffbb3f2210ae03539f7ff55d2a0b2a8ced45f1abf87e8ba5d5bb3087600334

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

regsvr32.exe

pid process

1952 regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.exeregsvr32.exe

description	pid	process	target process
PID 304 wrote to memory of 1952	304	cmd.exe	regsvr32.exe
PID 304 wrote to memory of 1952	304	cmd.exe	regsvr32.exe
PID 304 wrote to memory of 1952	304	cmd.exe	regsvr32.exe
PID 304 wrote to memory of 1952	304	cmd.exe	regsvr32.exe
PID 304 wrote to memory of 1952	304	cmd.exe	regsvr32.exe
PID 1952 wrote to memory of 1364	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1364	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1364	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1364	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1364	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1364	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1364	1952	regsvr32.exe	regsvr32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ʹ֮\ֶע.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:304
- C:\Windows\system32\regsvr32.exe
  regsvr32 test.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\regsvr32.exe
    test.dll
    3⤵
    PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-56-0x0000000000000000-mapping.dmp

Download
memory/1364-57-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1364-58-0x0000000010000000-0x0000000010176000-memory.dmp

Filesize
1.5MB

Download
memory/1952-54-0x0000000000000000-mapping.dmp

Download
memory/1952-55-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download