c24c4d805947b473c5f9abf3fa3b2168b1aaf8b282d612d004fd60774da49193 | Triage

Resubmissions

29/05/2023, 21:43

230529-1kzk2aea7x 6

29/05/2023, 21:40

230529-1h82paea7s 1

Analysis

max time kernel
1444s
max time network
1235s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2023, 21:43

Sharing

Report Analysis Logs

General

Target

scripts/scan_driver_packs.bat
Size

945B
MD5

2dbc6fd7355358866c8face4168a18ac
SHA1

80d767ff1d5ea1ac022cf2c213fd2583742734e9
SHA256

7c78826b30c054d407037d41368a40fabef133f1c83348290f0d756e05141e16
SHA512

e71c31e53429e9dd4eb9a02124a0867d10c96c275ecfcd1fd8e1e82f1f6bca82fa7b6d2c65ec3c27749a2f43028600286daf53b65421b67ffcc4335f888666cc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4944	2904	cmd.exe	83
PID 2904 wrote to memory of 4944	2904	cmd.exe	83
PID 2904 wrote to memory of 2948	2904	cmd.exe	84
PID 2904 wrote to memory of 2948	2904	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\scripts\scan_driver_packs.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b /od "C:\Users\Admin\AppData\Local\Temp\scripts\SDIO_R*.exe"
  2⤵
  PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b drivers\*.7z
  2⤵
  PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads