7b6feea50e84047dfc09ebddce5dcb8ff83e585e3bcc5429f9e254f7814ab0ce | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/09/2022, 16:27 UTC

Sharing

Report Analysis Logs

General

Target

test.bat
Size

228B
MD5

f6151b3e6f79fce1389c867ff5d3d214
SHA1

bfea3ab2464b9f806af8a21bee0c20d7c242364e
SHA256

7b6feea50e84047dfc09ebddce5dcb8ff83e585e3bcc5429f9e254f7814ab0ce
SHA512

13f507e8531899ffc5fcaf58ea848a70152331cbf652a3073b95cc74f737af0ca5f6ec9793c8a47552ff946cc3389c4149c9daf39ea45a0a9bf65a792a797c42

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1232	2040	cmd.exe	29
PID 2040 wrote to memory of 1232	2040	cmd.exe	29
PID 2040 wrote to memory of 1232	2040	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe --headless powershell @(5836,5855,5837,5832,5831,5780,5836,5851,5844,5781,5783,5789)
  2⤵
  PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads