1379fd67588484b8817a50e5fdfb37ced156e44b3a4f0fdd466409e481733ef5 | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:40

Sharing

Report Analysis Logs

General

Target

ʹ֮/ֶע.bat
Size

17B
MD5

024ae6ee0a93dc9298e272b75022908e
SHA1

d9fad8bad31c9a5a1c0a725ee5a9b2af021d2433
SHA256

38aa3d96459d6b7feb36e637564c4c75c1c1a2c186139dbb1c5e9600f95a81ce
SHA512

a642e0453281881b30c04d25d08366a5246d86582f481afa3bb28627aa8ef15745ffbb3f2210ae03539f7ff55d2a0b2a8ced45f1abf87e8ba5d5bb3087600334

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exeregsvr32.exe

description	pid	process	target process
PID 4896 wrote to memory of 4584	4896	cmd.exe	regsvr32.exe
PID 4896 wrote to memory of 4584	4896	cmd.exe	regsvr32.exe
PID 4584 wrote to memory of 4108	4584	regsvr32.exe	regsvr32.exe
PID 4584 wrote to memory of 4108	4584	regsvr32.exe	regsvr32.exe
PID 4584 wrote to memory of 4108	4584	regsvr32.exe	regsvr32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ʹ֮\ֶע.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\system32\regsvr32.exe
  regsvr32 test.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\regsvr32.exe
    test.dll
    3⤵
    PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4108-133-0x0000000000000000-mapping.dmp

Download
memory/4108-134-0x0000000010000000-0x0000000010176000-memory.dmp

Filesize
1.5MB

Download
memory/4584-132-0x0000000000000000-mapping.dmp

Download