dca8f8ce0a652c81fc9894b102feb8099366a2f0ba64892290c46a2605c2c52b | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/03/2023, 21:15

Sharing

Report Analysis Logs

General

Target

test.bat
Size

63B
MD5

5edcff91edc49be050b96a68f68f95bd
SHA1

b97dde35f636c022b4698172fafa2137d5c9d79f
SHA256

621814b35e92dabd039eeddb511a1325c98bf1330c0fb588f6bff314bfd83e43
SHA512

001906c256cfa9204180dd1332c3289c8bb03f76e4a28407f36dde89c35fb0f791340d6de8b14698271c05832a64d6ebc1c15bef2c382b7dd9b00c1b67b69316

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 840	1984	cmd.exe	28
PID 1984 wrote to memory of 840	1984	cmd.exe	28
PID 1984 wrote to memory of 840	1984	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\rundll32.exe
  rundll32.exe -e C:\Users\Admin\AppData\Local\Temp\sample.dll,#2
  2⤵
  PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads