27b70ff660c88c123b2f8cb1574972ce0b0e08bf18f64a93fdb69274753629da | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

CD/startd.cmd
Size

114B
MD5

50204828b87ca8f732fd755c2518dbb7
SHA1

ff07b258175fc16e33a05b933c49dea093f5abda
SHA256

f78b03e49c67959c3576138381912259dd22213cc78a4f86770cb95cf053ef44
SHA512

8625bc517aac0d7b357549bfc2a3441a2cef2784cd1d9d93bd6d95d071bf8895bd0c107ac0a76c7fc424fbefd82b67fff404bf1a5b4ad3f4a0d0b29aefccf4b8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2704	2772	cmd.exe	31
PID 2772 wrote to memory of 2704	2772	cmd.exe	31
PID 2772 wrote to memory of 2704	2772	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CD\startd.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\system32\cmd.exe
  cmd.exe /D /C"(md c:\$uvs_285 || cd c:\$uvs_285) && copy /Y uvs\*.* c:\$uvs_285 && start c:\$uvs_285\start.exe /D"
  2⤵
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads