45449bf222593b8ba442e660e3a1b2ffaa58a92ae0c56627cfe9c4bcf7b93cdc | Triage

Analysis

max time kernel
94s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:42

Sharing

Report Analysis Logs

General

Target

cmd.bat
Size

189B
MD5

6f15cd0263b458116b6698e266ab989c
SHA1

83b44519c7a36583e69f2b65dc44738b3ee63145
SHA256

9b584a85e3fa666d0e2d6e699f2c1380a788cae2183e417ddd7b58a3939b9112
SHA512

892c34b984ac66748e54da0f0b9728c2a02c7bb6932e6fb385daed8f0b855198d3be91d6ade589827e43b2604b186fe7c39b5ffae6589d6cb2037595c3a56866

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4220	2568	cmd.exe	83
PID 2568 wrote to memory of 4220	2568	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\mesh-64.dat,DllMain --ma="license.dat"
  2⤵
  PID:4220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads