8e1006e5f230f269bb9ce80e5c2b7f3b930cb68f3d975697d45b4e4bae33ce58 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 00:16

Sharing

Report Analysis Logs

General

Target

getword/GetWordDemo/UnRegister.bat
Size

30B
MD5

454cdee88e9e7850ee5f17ec175f8828
SHA1

a2b4708b4beb95a2c0476e6cde6eb5c4e72d5a2a
SHA256

25268f7e573d1da204abb5e2be2d9d59c216c2896324966b5d3484fd4cf134bf
SHA512

28a0a91385ded399f2dc291ff227021949ad3a089451786810837ca51cb1ef9e41ef9f66fd59878a4409adc6b08b0de3c70a35c25cfd12c8518f959e991f962c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1776	5044	cmd.exe	89
PID 5044 wrote to memory of 1776	5044	cmd.exe	89
PID 1776 wrote to memory of 2680	1776	regsvr32.exe	90
PID 1776 wrote to memory of 2680	1776	regsvr32.exe	90
PID 1776 wrote to memory of 2680	1776	regsvr32.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\getword\GetWordDemo\UnRegister.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\system32\regsvr32.exe
  RegSvr32 /s /u "GetWord.ocx"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /u "GetWord.ocx"
    3⤵
    PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads