54aa0629030dd73c87c439e09e0dda942775da54b61ffde9844ca2bd2cfb07a7 | Triage™

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15/12/2022, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
staunch/enfeebles.cmd
Size 275B
Sample221215-vs55wsfh2s
SHA256 0e6761acc6a4da6c360730da8c1a3a03e782058c51bb95e47946f52a7524bada
MD5 d612a00764fec9d6de3ea90f486e273b
SHA1 bf1b3f10775eb282d1b58369a8a9f61ecadd207a
SHA512 cc3d693bb2c91b9fa78e1f138ddafa9269df76925a0769b9e322c992557412bbfdd19a2e74a45d532cb0a5ee320d04eb082bf83cb3edc66d86a486ec1e0a300f
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1236	940	cmd.exe	29
PID 940 wrote to memory of 1236	940	cmd.exe	29
PID 940 wrote to memory of 1236	940	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\staunch\enfeebles.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\system32\replace.exe
  replace C:\Windows\\32\\L32.eXe C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads