764d884dabdc19f38ee270ca65e27afaf3e5731c54e8cafc5f30d757b83e26b7 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 18:41

Sharing

Report Analysis Logs

General

Target

cmd.bat
Size

187B
MD5

72f9832e26f22c251765dbd43dd7b19f
SHA1

dece15cb77c851e678126056b32a1ea7b72400fa
SHA256

5847171289735b17b8dacc1d126eaf54e7624d429de0661b76d3ce6cd399e8f4
SHA512

286190dd030d53f346ad14ddd20f7dee137f92732c79e2ac7b45bdbf22a1a633e79b9ea15676127d213b3f040469b9cba62211247fc304d71e00e0761872161e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1808	2272	cmd.exe	31
PID 2272 wrote to memory of 1808	2272	cmd.exe	31
PID 2272 wrote to memory of 1808	2272	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\pony_.tmp,DllMain --ma="license.dat"
  2⤵
  PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads