d4db23f863ce5f313bf92bea05d5b136bdf182fc7d7d4ebb88e10940e76262f4 | Triage

Analysis

max time kernel
30s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/03/2023, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

_crack_installer.bat
Size

3KB
MD5

0f80aabf654b697aa059f401a0bd1448
SHA1

987a24d5ab07bfb0fdced0ebf653c9c358fe1725
SHA256

d4db23f863ce5f313bf92bea05d5b136bdf182fc7d7d4ebb88e10940e76262f4
SHA512

47a69e41859c0f4a86b43d9f28ec9d084e15f96014ee6770b8cfe8923cc494d4ba6eaf0eec040fa184ec071011ee16a092e6672162ae129bcb9c509d3bc00d7f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1304	1956	cmd.exe	28
PID 1956 wrote to memory of 1304	1956	cmd.exe	28
PID 1956 wrote to memory of 1304	1956	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\_crack_installer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads