ff36edbe722ed60b5fa69971dfe1eda52dfb4ea353894d79d746cb74d1643ec0 | Triage

Analysis

max time kernel
31s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 09:44

Sharing

Report Analysis Logs

General

Target

run.bat
Size

44B
MD5

1a21eac77ee210f3df6a54913f5b265e
SHA1

0a114c45d3327ec1010e3bc70a0558fe0ceac248
SHA256

5729961fa42c2dbfffab8c405a583bda86f291084e11ca7d034a99f551553f06
SHA512

b819c6628f9a0c22f58cea95c370cffca3c263b5d0a2ffdfb458ad1baa517b698417ee64c414761ce7b7f2941d6366f50d2773509a6852e4af2e8d72c0bb886b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1228	rundll32.exe
1228	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1228	1780	cmd.exe	27
PID 1780 wrote to memory of 1228	1780	cmd.exe	27
PID 1780 wrote to memory of 1228	1780	cmd.exe	27

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\system32\rundll32.exe
  rundll32.exe libsodium.dll,vcab /k baunti184
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-54-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download