a0434d04361c1d13481971f4072681781b2075a5c8025c028ef85f50357b808c | Triage™

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
21/11/2023, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher.bat
Size 58B
Sample231121-lez72sec8v
SHA256 c39dcd3c17b7584821e73ec7fd48faf9d7cc36a25bb6a0dcb0db16b3fdacfd13
MD5 b2f5850d6e5fa7247b33e72254653a56
SHA1 35538388d294259df30f4d9d68f00b75c5f60696
SHA512 c64fb0dc93107ddf54ac692288a82df15071e7ede56e1ec81f43bef36c43833fc0c6dd1cbde79ff8810e3623adf6d04a3d099e0da76f9bc16cd0aad7cf9f1b9a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2664	1676	cmd.exe	29
PID 1676 wrote to memory of 2664	1676	cmd.exe	29
PID 1676 wrote to memory of 2664	1676	cmd.exe	29
PID 2664 wrote to memory of 2656	2664	rundll32.exe	30
PID 2664 wrote to memory of 2656	2664	rundll32.exe	30
PID 2664 wrote to memory of 2656	2664	rundll32.exe	30
PID 2664 wrote to memory of 2656	2664	rundll32.exe	30
PID 2664 wrote to memory of 2656	2664	rundll32.exe	30
PID 2664 wrote to memory of 2656	2664	rundll32.exe	30
PID 2664 wrote to memory of 2656	2664	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\rundll32.exe
  rundll32.exe inf2.dll,Limit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe inf2.dll,Limit
    3⤵
    PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-0-0x0000000000170000-0x0000000000173000-memory.dmp

Download

memory/2656-1-0x00000000008E0000-0x00000000009AA000-memory.dmp

Download