15c1feb12ecedafc233ebec6e0893ed0294f91ad48da9cc89c571ce3e316980d | Triage

Analysis

max time kernel
45s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 15:09

Sharing

Report Analysis Logs

General

Target

discoveries/dispersers.cmd
Size

291B
MD5

0113de80cf8c28384998b91527148ca4
SHA1

24a2564b57b49dcf65402a776422173aa8b2b86a
SHA256

feb1857e7ce32fbee82dfa8a0f4d53deed9a7ea841122cd4a8c84c5d43c61439
SHA512

eefb2612b57921bbc8fcf80ae7ceb61844f2a509d03e3e19a02d9736dd63f5d1bde735c552e990d5332e874d8394ed442fb1c94fb13dc17eba172de96c63e007

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1324 wrote to memory of 1168	1324	cmd.exe	replace.exe
PID 1324 wrote to memory of 1168	1324	cmd.exe	replace.exe
PID 1324 wrote to memory of 1168	1324	cmd.exe	replace.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\discoveries\dispersers.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:1168

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-54-0x0000000000000000-mapping.dmp

Download