21c3dda1705a30f4d677e8bfbda332ca184e75fa377bf83e64e579209f360962 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:42

Sharing

Report Analysis Logs

General

Target

PurgeAcrylicCacheData.bat
Size

46B
MD5

a69ff4c18363c9cd29f5c6e6aae04953
SHA1

a4e719ed79a0eddf0ce253d719a3a201bb0b0d7d
SHA256

9869b7ae68f2fc04d5582067726b0a8fd04817b8369eb2ee44821305c7e425bc
SHA512

2f69b6aed6c7f5d2b51dafd0c67eab7b7114954ee83d152b17c075636628ea028d4abc9d9343a1d67ccbf1a4a0a81c8e0d1407134fcb3c9073f8c893171d27c3

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

AcrylicUI.exe

pid process

1684 AcrylicUI.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AcrylicUI.exe

pid process

1684 AcrylicUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2756 wrote to memory of 1684	2756	cmd.exe	AcrylicUI.exe
PID 2756 wrote to memory of 1684	2756	cmd.exe	AcrylicUI.exe
PID 2756 wrote to memory of 1684	2756	cmd.exe	AcrylicUI.exe
PID 2756 wrote to memory of 1684	2756	cmd.exe	AcrylicUI.exe
PID 2756 wrote to memory of 1684	2756	cmd.exe	AcrylicUI.exe
PID 2756 wrote to memory of 1684	2756	cmd.exe	AcrylicUI.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PurgeAcrylicCacheData.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Users\Admin\AppData\Local\Temp\AcrylicUI.exe
AcrylicUI.exe PurgeAcrylicCacheData
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1684-1-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download