d0da063e0dad6f9b92888f7aaa95887474fedbb786a2c9dff7d72fc81caf18ff | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 11:58

Sharing

Report Analysis Logs

General

Target

cfsamdsfzrej_gr/LOL意哥破解版/插件注册失败打开.bat
Size

28B
MD5

f5dd85d817d4b023053c3999d7095dbb
SHA1

83d10b603a71b45e2c06e168d4d07259ad15d009
SHA256

7fec325d3f869a0b0214139a87b1dde716d4931923916e6fe58eefd7b6cfdea0
SHA512

8f69d8f854e0e2494ad6314925ac515e57d98dc6dc20f7960dfd8efe62b14ed4904c086207203d278ee5b82bd328b2643e9e27e794905cdd30b9296d4cbb394d

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

regsvr32.exe

pid process

2952 regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2724 wrote to memory of 2952	2724	cmd.exe	regsvr32.exe
PID 2724 wrote to memory of 2952	2724	cmd.exe	regsvr32.exe
PID 2724 wrote to memory of 2952	2724	cmd.exe	regsvr32.exe
PID 2724 wrote to memory of 2952	2724	cmd.exe	regsvr32.exe
PID 2724 wrote to memory of 2952	2724	cmd.exe	regsvr32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cfsamdsfzrej_gr\LOL意哥破解版\插件注册失败打开.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\regsvr32.exe
  regsvr32 "C:\windows\yg.dll"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x0000000001D90000-0x0000000001D91000-memory.dmp

Filesize
4KB

Download