a020a24b26e565454583d62597ad41b18bf036d6c154e1498587784c528bd529 | Triage

Analysis

max time kernel
43s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11/02/2023, 14:42

Sharing

Report Analysis Logs

General

Target

WannaCrypt0r.bat
Size

53B
MD5

900a546f6ef90b4f043b2853ed6a6d20
SHA1

09907fac8be5831fd4d696d87259ec3044aebe1e
SHA256

a020a24b26e565454583d62597ad41b18bf036d6c154e1498587784c528bd529
SHA512

fd58b94553b985239cddd249be57fc550e6f30c5cd38eb3e431e0c71d1c84d9e835678841a187bf0060fe5053aa2e7a7590eb02b3612734fdc6d29bdbcdc9c6a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 332	272	cmd.exe	29
PID 272 wrote to memory of 332	272	cmd.exe	29
PID 272 wrote to memory of 332	272	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\WannaCrypt0r.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\system32\wscript.exe
  wscript "WannaCrypt0r\demon.js"
  2⤵
  PID:332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads