Analysis

  • max time kernel
    140s
  • max time network
    155s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/04/2024, 13:32

General

  • Target

    start-server.bat

  • Size

    123B

  • MD5

    3798fb8eb473c4a6311314c6923ff485

  • SHA1

    0ac527028375eb760fbcb917a6016857ceffedbc

  • SHA256

    131e7ea3f8e4ae359fef01a689ec0c6e113752712cb86624f5705333ac6a41f3

  • SHA512

    31164ab7a32e16a448a2c06b9ef3c6c74c7f898e0ba312767b5fe2d44cfbe1a562f844203ac9e3c0334855e81f30649304acc85e97c83be7bc9481d927005755

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start-server.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Users\Admin\AppData\Local\Temp\TerrariaServer.exe
      TerrariaServer.exe -config serverconfig.txt
      2⤵
        PID:4356
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 800
          3⤵
          • Program crash
          PID:3352

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4356-0-0x0000000000690000-0x0000000000698000-memory.dmp

            Filesize

            32KB

          • memory/4356-1-0x0000000073BA0000-0x000000007428E000-memory.dmp

            Filesize

            6.9MB

          • memory/4356-2-0x0000000005020000-0x000000000518C000-memory.dmp

            Filesize

            1.4MB

          • memory/4356-3-0x0000000073BA0000-0x000000007428E000-memory.dmp

            Filesize

            6.9MB