c640adc8c6c82e658ccc5595ac2ca3c1c226a87206ae8a1e31c3db261aeac0df

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-02-2023 13:11

Target

topicsMain.bat
Size

1KB
MD5

5ac482d3d3dce722972fae6a69fc8bce
SHA1

66744f07e3775b22572d1fd8fc60a58b47babc96
SHA256

311b4dc7cb37d5e22502ac5e6e7414ed3fc94777dac8cb0d7f234e3fd6702143
SHA512

abea1cddd5ad90c7b1f2859a14724a04bcfab61f38cbb81686ecb338d8f70d040afe0eaf1f572dfb7be26a9c9605cd44682ffa6335f90bcc8993d1d4eba0dc8e

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1376	1628	cmd.exe	29
PID 1628 wrote to memory of 1376	1628	cmd.exe	29
PID 1628 wrote to memory of 1376	1628	cmd.exe	29
PID 1376 wrote to memory of 632	1376	cmd.exe	30
PID 1376 wrote to memory of 632	1376	cmd.exe	30
PID 1376 wrote to memory of 632	1376	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\topicsMain.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\cmd.exe
  cmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\TUmLJFkwKhG.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\TUmLJFkwKhG.exe
    3⤵
    PID:632

memory/1628-56-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp

Filesize
8KB

Download