3041536c2a8e1a90ee11ba958e9ee764404a801fda04af11d256475064f752a6 | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
14-12-2022 23:03

Sharing

Report Analysis Logs

General

Target

unmarketable/placeable.cmd
Size

317B
MD5

e768f8b4f2dbd0bf62eb438c6d602a12
SHA1

e7dfcacc113f40e04fc7fe00d5058f02fd3e46cd
SHA256

f89bf878e9ead03466cd2cea24d24dbec2bc75796380a9fa1ec84dc24b53ce1d
SHA512

e1c3fe25821b9e5f6059a8d580ed8b34095baa8334d87519f41f580f3dca04a28697ed2e6354641cd31f6eabc30f299c446e0b39f461b529a18df48cd3102aa1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 840 wrote to memory of 2008	840	cmd.exe	replace.exe
PID 840 wrote to memory of 2008	840	cmd.exe	replace.exe
PID 840 wrote to memory of 2008	840	cmd.exe	replace.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\unmarketable\placeable.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:2008

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-54-0x0000000000000000-mapping.dmp

Download