8e1006e5f230f269bb9ce80e5c2b7f3b930cb68f3d975697d45b4e4bae33ce58 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

getword/GetWordDemo/UnRegister.bat
Size

30B
MD5

454cdee88e9e7850ee5f17ec175f8828
SHA1

a2b4708b4beb95a2c0476e6cde6eb5c4e72d5a2a
SHA256

25268f7e573d1da204abb5e2be2d9d59c216c2896324966b5d3484fd4cf134bf
SHA512

28a0a91385ded399f2dc291ff227021949ad3a089451786810837ca51cb1ef9e41ef9f66fd59878a4409adc6b08b0de3c70a35c25cfd12c8518f959e991f962c

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3024	regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3024	2960	cmd.exe	29
PID 2960 wrote to memory of 3024	2960	cmd.exe	29
PID 2960 wrote to memory of 3024	2960	cmd.exe	29
PID 2960 wrote to memory of 3024	2960	cmd.exe	29
PID 2960 wrote to memory of 3024	2960	cmd.exe	29
PID 3024 wrote to memory of 3036	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3036	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3036	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3036	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3036	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3036	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3036	3024	regsvr32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\getword\GetWordDemo\UnRegister.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\regsvr32.exe
  RegSvr32 /s /u "GetWord.ocx"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /u "GetWord.ocx"
    3⤵
    PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads