2052b4ce077f8a5e26656c804ddd1887dacf0e9839986b100eca73196db46086 | Triage

Analysis

max time kernel
144s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
08-12-2022 14:08

Sharing

Report Analysis Logs

General

Target

fumigating/perplexity.cmd
Size

286B
MD5

c9272f3098f5af0eb3179c5c764e5cd5
SHA1

fa991da35d87d491c373e1ea90500f885ceb645d
SHA256

8821636bd9b82c303dc65dcfa986ee1d1b67463a84bfe940ee19d3dff86f2dcf
SHA512

04f25f060ab5d4b4b64cd8afdfdff808056346a9a8f1c9bf13a7948874c9360b91f707b79b5f292e8fd2ca6f0111bfccef6eeef7a20c0411c6e1ea971eda7153

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2692 wrote to memory of 3668 2692 cmd.exe replace.exe
PID 2692 wrote to memory of 3668 2692 cmd.exe replace.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fumigating\perplexity.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:3668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3668-120-0x0000000000000000-mapping.dmp

Download