80f39a11a179b4b0829192f0283f53b4170347f760deb4b40b346ac99bba4d87 | Triage

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/04/2023, 23:37

Sharing

Report Analysis Logs

General

Target

empyrean-main/build.bat
Size

664B
MD5

85857405eca41f5e898322bf94400313
SHA1

f5d0e3170eea75ca0d19e237a9c9becd6e7988a2
SHA256

d26347df3e03141a940477d79848e5322bbdb2a71dc6c603f2d980c862421ab3
SHA512

16f4c957d1d4c07292e3bb0ed75874b7ecad7716bcb134d29a07bfcc96531c6775869996631eb74910d4e32c9513f54345e79fdb65534b2925ff82fefeca36c5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1232	1424	cmd.exe	29
PID 1424 wrote to memory of 1232	1424	cmd.exe	29
PID 1424 wrote to memory of 1232	1424	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\empyrean-main\build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads