9e254e8136832a2c2a450992f7f8e68e3c19b697ff97095dd020650df8ca48f0 | Triage

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 18:48

Sharing

Report Analysis Logs

General

Target

core 2/cmd.bat
Size

188B
MD5

bd1b70c8c1bfd69c1eef4b5e331f1286
SHA1

d05ab643ab2d8920b361ff92607bec051a5c494b
SHA256

4aff5f8cea0cd666039dcad0f6b343e1ad5aa9903d8cb76eed98d423d051f58e
SHA512

8f1f07e0f8f02b54ec6bcc6cda58b41464a7b7ac5c3392dd03635fcebbd3fd231e758f187861f037224abde4755faa1ab7cb627ec43e582f693a877f852949f2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2268	3060	cmd.exe	84
PID 3060 wrote to memory of 2268	3060	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core 2\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\flush-32.dat,update /i:"license.dat"
  2⤵
  PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads