1d59b62092422db48a95109b96badc464461d6c0ebdc98cdf00741b4e5cf4de3 | Triage

Analysis

max time kernel
230s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 14:03

Sharing

Report Analysis Logs

General

Target

sandalwood/mynah.cmd
Size

299B
MD5

da182f2f18108a219f8ef565e54868e6
SHA1

5db854d6814cae549ab0389fa043a7b48f5d80dc
SHA256

f861ae19db7fb3de597e5bb2fa83fc387cda06108461b805bda8025849e04fff
SHA512

f18aa570d02507604a024edce17b15cb7f1e8790d7f865a54180a224ce6bcb66eeb7df9e96a1742c9b01923858c243bc750cc2f77e3b010c02364343a1da939f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 860 wrote to memory of 820	860	cmd.exe	replace.exe
PID 860 wrote to memory of 820	860	cmd.exe	replace.exe
PID 860 wrote to memory of 820	860	cmd.exe	replace.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\sandalwood\mynah.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:820

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-54-0x0000000000000000-mapping.dmp

Download