39f4de6c82203a2769745f568198d028d37f0ec72792adb18de98a958f59e968 | Triage

Resubmissions

05-12-2022 21:11

221205-z14z1sbc4z 10

05-12-2022 21:02

221205-zvg83aae9z 10

05-12-2022 20:55

221205-zqp34sab9t 10

Analysis

max time kernel
597s
max time network
604s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 21:11

Sharing

Report Analysis Logs

General

Target

undampened/reassembly.cmd
Size

285B
MD5

0e1d1b53085414be80108431a3ee03ec
SHA1

23d01d536acdf7d9cfaabcf97c63ad435652e6da
SHA256

d25cf833e6fb446b1c38fee115eb1a1bfb70657ada48f5f20dce799ddade625f
SHA512

3ed5af192d5d95be221c279c256c404128a2ef9ac70f48057e5db671566ddbf371d953d45616e29fc6e4008a04c51fa3c3743a388bee03f91a7a5594209a279d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 208 wrote to memory of 4356 208 cmd.exe replace.exe
PID 208 wrote to memory of 4356 208 cmd.exe replace.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\undampened\reassembly.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:208

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:4356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4356-132-0x0000000000000000-mapping.dmp

Download