d4db23f863ce5f313bf92bea05d5b136bdf182fc7d7d4ebb88e10940e76262f4 | Triage

Analysis

max time kernel
78s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2023 01:19

Sharing

Report Analysis Logs

General

Target

_crack_installer.bat
Size

3KB
MD5

0f80aabf654b697aa059f401a0bd1448
SHA1

987a24d5ab07bfb0fdced0ebf653c9c358fe1725
SHA256

d4db23f863ce5f313bf92bea05d5b136bdf182fc7d7d4ebb88e10940e76262f4
SHA512

47a69e41859c0f4a86b43d9f28ec9d084e15f96014ee6770b8cfe8923cc494d4ba6eaf0eec040fa184ec071011ee16a092e6672162ae129bcb9c509d3bc00d7f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2188	2936	cmd.exe	87
PID 2936 wrote to memory of 2188	2936	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_crack_installer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads