42c77f89ea1a298098ecf3e8939f6c5ccd005742d0482047ee26fbf56728c684

Resubmissions

23/05/2023, 13:55

23/05/2023, 13:40

23/05/2023, 13:38

23/05/2023, 12:40

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2023, 13:55

Target

test.bat
Size

370B
MD5

1157be1803e2f740eec3a0c69aa44625
SHA1

5963efa7895a6748e74f0aeb94a3b3856787b8c5
SHA256

42c77f89ea1a298098ecf3e8939f6c5ccd005742d0482047ee26fbf56728c684
SHA512

04d698560789eb87f9fdbc32468557d05655558d289749f263fba4cdeb26b1cf83c214c316d60184856a935a9da757a62c361ca8e41804b59606a068a18f3899

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2332	1292	WerFault.exe	87

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1176	1340	cmd.exe	86
PID 1340 wrote to memory of 1176	1340	cmd.exe	86
PID 1340 wrote to memory of 4164	1340	cmd.exe	85
PID 1340 wrote to memory of 4164	1340	cmd.exe	85
PID 1340 wrote to memory of 5084	1340	cmd.exe	84
PID 1340 wrote to memory of 5084	1340	cmd.exe	84
PID 1340 wrote to memory of 3316	1340	cmd.exe	83
PID 1340 wrote to memory of 3316	1340	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\system32\findstr.exe
  findstr /i "6\.1\."
  2⤵
  PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:5084
- C:\Windows\system32\findstr.exe
  findstr /i "10\.0\.19045\."
  2⤵
  PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:1176

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 1292 -ip 1292
1⤵
PID:4716

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1292 -s 2284
1⤵
- Program crash
PID:2332