7b6feea50e84047dfc09ebddce5dcb8ff83e585e3bcc5429f9e254f7814ab0ce | Triage

Analysis

max time kernel
65s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2022, 16:27

Sharing

Report Analysis Logs

General

Target

test.bat
Size

228B
MD5

f6151b3e6f79fce1389c867ff5d3d214
SHA1

bfea3ab2464b9f806af8a21bee0c20d7c242364e
SHA256

7b6feea50e84047dfc09ebddce5dcb8ff83e585e3bcc5429f9e254f7814ab0ce
SHA512

13f507e8531899ffc5fcaf58ea848a70152331cbf652a3073b95cc74f737af0ca5f6ec9793c8a47552ff946cc3389c4149c9daf39ea45a0a9bf65a792a797c42

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4384	4656	cmd.exe	82
PID 4656 wrote to memory of 4384	4656	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe --headless powershell @(5836,5855,5837,5832,5831,5780,5836,5851,5844,5781,5783,5789)
  2⤵
  PID:4384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads