3b1a4e1dfe4ef2c26fa5fd639781d3bcd829148950c2b5eb131d787fb561bac6 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 17:05

Sharing

Report Analysis Logs

General

Target

launcher.bat
Size

82B
MD5

f7e345f70f46e2cc0dad5faa3a820ed3
SHA1

99ae1378cb1800a82cec426e7d633debcad553f7
SHA256

ca6b741c380d7c4e05d1e7d0a27ddf234b6b91765d822a38facc7861c1d50663
SHA512

2f9a0500c32c72659c47c622547c3e6206d3de5f193dc1774f15b98d301cda404aa880c13dbf29ba0b7ed508c3be7559d795db9662a2432435c3dbdf6a8ba2fc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2084	2888	cmd.exe	29
PID 2888 wrote to memory of 2084	2888	cmd.exe	29
PID 2888 wrote to memory of 2084	2888	cmd.exe	29
PID 2084 wrote to memory of 2300	2084	rundll32.exe	30
PID 2084 wrote to memory of 2300	2084	rundll32.exe	30
PID 2084 wrote to memory of 2300	2084	rundll32.exe	30
PID 2084 wrote to memory of 2300	2084	rundll32.exe	30
PID 2084 wrote to memory of 2300	2084	rundll32.exe	30
PID 2084 wrote to memory of 2300	2084	rundll32.exe	30
PID 2084 wrote to memory of 2300	2084	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\rundll32.exe
  rundll32.exe documents_PO17012024.pdf.dll,DKPQbOkEZ
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe documents_PO17012024.pdf.dll,DKPQbOkEZ
    3⤵
    PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-0-0x00000000025B0000-0x000000000274A000-memory.dmp

Filesize
1.6MB

Download
memory/2300-4-0x0000000002410000-0x00000000025AD000-memory.dmp

Filesize
1.6MB

Download
memory/2300-2-0x0000000002010000-0x00000000021AA000-memory.dmp

Filesize
1.6MB

Download
memory/2300-5-0x0000000002410000-0x00000000025AD000-memory.dmp

Filesize
1.6MB

Download