d1a4dc15a7396670b93d6a28ea2b3a54a8f19181aed1bbdb6ae1cbe28152c060 | Triage

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-01-2023 16:47

Sharing

Report Analysis Logs

General

Target

copillwonv/hipsexfryd.cmd
Size

1KB
MD5

cd4e29cd2e40036a15420ebc25ea24d2
SHA1

b867b239b49326ac7aec9986b60620f7c256e7a4
SHA256

6da903d156a109167a30e55cf323815a4418d439976232523fd3b71c04df87dc
SHA512

fb88d965ce0fed7c997cb377881c51c9bc3fa9b003577e20eadd4e279991eee46985afeaf4a0a42d38261cdf371561c04e28b5ae0f204c41cf098ea6ca2bae2a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1896 wrote to memory of 1920	1896	cmd.exe	xcopy.exe
PID 1896 wrote to memory of 1920	1896	cmd.exe	xcopy.exe
PID 1896 wrote to memory of 1920	1896	cmd.exe	xcopy.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\copillwonv\hipsexfryd.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\system32\xcopy.exe
  xcopy /s /i /e /h copillwonv\strapping.dat C:\Users\Admin\AppData\Local\Temp\*
  2⤵
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-54-0x0000000000000000-mapping.dmp

Download