42c77f89ea1a298098ecf3e8939f6c5ccd005742d0482047ee26fbf56728c684

Resubmissions

23/05/2023, 13:55

23/05/2023, 13:40

23/05/2023, 13:38

23/05/2023, 12:40

max time kernel
51s
max time network
75s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
23/05/2023, 13:55

Target

test.bat
Size

370B
MD5

1157be1803e2f740eec3a0c69aa44625
SHA1

5963efa7895a6748e74f0aeb94a3b3856787b8c5
SHA256

42c77f89ea1a298098ecf3e8939f6c5ccd005742d0482047ee26fbf56728c684
SHA512

04d698560789eb87f9fdbc32468557d05655558d289749f263fba4cdeb26b1cf83c214c316d60184856a935a9da757a62c361ca8e41804b59606a068a18f3899

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4392	4452	cmd.exe	67
PID 4452 wrote to memory of 4392	4452	cmd.exe	67
PID 4452 wrote to memory of 2160	4452	cmd.exe	68
PID 4452 wrote to memory of 2160	4452	cmd.exe	68
PID 4452 wrote to memory of 2144	4452	cmd.exe	69
PID 4452 wrote to memory of 2144	4452	cmd.exe	69
PID 4452 wrote to memory of 2156	4452	cmd.exe	70
PID 4452 wrote to memory of 2156	4452	cmd.exe	70

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:4392
- C:\Windows\system32\findstr.exe
  findstr /i "10\.0\.19045\."
  2⤵
  PID:2160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:2144
- C:\Windows\system32\findstr.exe
  findstr /i "6\.1\."
  2⤵
  PID:2156