19445d47b6904e3ce904e119ae583d286b6d2c001161b598f5c3ce2e64485792 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-01-2023 05:13

Sharing

Report Analysis Logs

General

Target

Inv_162_Jan-01_Copy/eveeftwedK/oakhidtino.cmd
Size

1KB
MD5

9462edd137b82de190978b35d062e56c
SHA1

aeb49a7d86d9fae2f09a8f7b7d926991c5887b8b
SHA256

28d9ce04d42d61d8b4423997fd60087bd23285b06c4b79b72a3dcb7d13de2ec6
SHA512

e9fee5f87f3d4c7246b7d23293a0c68a7ecf4ea0991e83679e68b45035a5fd6251f786fc13b796286fbae055fcd9511e06fa5a31e6ebfad8009c2dc887a6aaaa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 900 wrote to memory of 948	900	cmd.exe	xcopy.exe
PID 900 wrote to memory of 948	900	cmd.exe	xcopy.exe
PID 900 wrote to memory of 948	900	cmd.exe	xcopy.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Inv_162_Jan-01_Copy\eveeftwedK\oakhidtino.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\system32\xcopy.exe
xcopy /s /i /e /h eveeftwedK\blessing.dat C:\Users\Admin\AppData\Local\Temp\*
2⤵
PID:948

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-54-0x0000000000000000-mapping.dmp

Download