a13a66488151b47508a2dd043f8010ad91b96638c0b1a6f83ebbb82c4cb4fc5e | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
20-11-2023 16:07

Sharing

Report Analysis Logs

General

Target

launcher.bat
Size

58B
MD5

f627a4b4c2c27385f8f82152aa576808
SHA1

a8d71fc8958dda6dea7165c46721061bd659da81
SHA256

4f2b4b4a37ccd633ee482dba7190ef279d53d103cdb14bbf1d0cf3cf60cc2a1f
SHA512

e9c1a0f88ad85199f63224142c35309fb0a15ae3d696706f8eece9e0026533068351fe8d7f3f9ea928ef590ac71c9bf81f887c70a214d3236271b7e01aba1e2b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1880 wrote to memory of 2836	1880	cmd.exe	rundll32.exe
PID 1880 wrote to memory of 2836	1880	cmd.exe	rundll32.exe
PID 1880 wrote to memory of 2836	1880	cmd.exe	rundll32.exe
PID 2836 wrote to memory of 2960	2836	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 2960	2836	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 2960	2836	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 2960	2836	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 2960	2836	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 2960	2836	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 2960	2836	rundll32.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\system32\rundll32.exe
rundll32.exe RIRS.dll,Excpt
2⤵
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe RIRS.dll,Excpt
3⤵
PID:2960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-0-0x0000000000110000-0x0000000000113000-memory.dmp

Filesize
12KB

Download
memory/2960-1-0x0000000001FB0000-0x0000000002082000-memory.dmp

Filesize
840KB

Download