aed6fa21f9625256cab82fe39d326c2a47f0c7987bf6a8edbfaf0819f3f13df1 | Triage

Analysis

max time kernel
86s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2023 21:09

Sharing

Report Analysis Logs

General

Target

test.bat
Size

61B
MD5

096f3372b83a509adbf0df08dfd6adc3
SHA1

31f83e54f1315ce5ed741763ef234f3a526802bb
SHA256

828b24d333ec3fc167a3812cc5214ba760bd51e2bf21afec9cb205cec5fc93b0
SHA512

b63157a584c699165fdc29f216451f7fde4272072ebb1ade2213c281de350e0926ba9bdc7061f953c49c0e44c25cf158b9c1a5f797882316d6b7cc43293cdcb6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2144 wrote to memory of 3132 2144 cmd.exe regsvr32.exe
PID 2144 wrote to memory of 3132 2144 cmd.exe regsvr32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\system32\regsvr32.exe
regsvr32.exe -e C:\Users\Admin\AppData\Local\Temp\test.dll,#2
2⤵
PID:3132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...