1204c2bc02431a696c9d452daf3b77672f9001b6ef7abea6c5384d8091a545e9 | Triage

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 05:22

Sharing

Report Analysis Logs

General

Target

friskingly/classics.cmd
Size

305B
MD5

7bce54e12656f0aba6ad783698b32bb1
SHA1

cae9d14d2f47e02c968bddbf361e4e70af1c4977
SHA256

2e8fe805c67f67a413e4040dcdce0f847f86c021820d426d3b35b20040d3772e
SHA512

980a6dc4bbe77f7bfd54db5ab5d8655619cf132769e8d0a9a9f59586330928e60711da6b6768c6cda14a2d34d5d97915e45d322c4a8904dfbd08442dda9fc87c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1348 wrote to memory of 844	1348	cmd.exe	replace.exe
PID 1348 wrote to memory of 844	1348	cmd.exe	replace.exe
PID 1348 wrote to memory of 844	1348	cmd.exe	replace.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\friskingly\classics.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:844

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-54-0x0000000000000000-mapping.dmp

Download