c40963bc270afc2d94e76fc822ded2263f45f6c00f4b82459d34df5b632fa790 | Triage

Resubmissions

05-12-2022 21:50

221205-1px8rsdf7x 10

05-12-2022 21:36

221205-1fxwmshg72 10

05-12-2022 21:13

221205-z2tknsbd2y 10

02-12-2022 18:49

221202-xgbs1sdc28 10

Analysis

max time kernel
583s
max time network
587s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 21:36

Sharing

Report Analysis Logs

General

Target

amended/depressurize.cmd
Size

294B
MD5

4478916ab6a542ba83d159f91d65c49a
SHA1

acf13927bc140cc3ae0e49de3c750adb78600002
SHA256

36754f9a2fe5f46e64976d49b253894de757a5fc9b1d7a81daf45c450529d0ad
SHA512

4ac53a5fbc1114095dba189edb0312fb8f1dd98f11dcf765281e10f977434795ccec172e4091187591006e677081a7c2ef100badefd9eb9504ec07ed69ccc558

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1660 wrote to memory of 1476 1660 cmd.exe replace.exe
PID 1660 wrote to memory of 1476 1660 cmd.exe replace.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\amended\depressurize.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-132-0x0000000000000000-mapping.dmp

Download