4f98137a7d8cea117fe163661d28f4a4f8cbdc93187bc21456bc9b9446e18015

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2023, 01:53

Target

memenite-master/Run me.bat
Size

45KB
MD5

4c3f1f1a63102a7b6f8167a95d2dc975
SHA1

246d06defdee8289f77ef8f964166c9cf5e9de20
SHA256

2249ecf66baece44e152eedd9c2e10c9593fdedb22265b1246d096dd323d522b
SHA512

9e908893e8ad10a537a910092451c9a04f175474bd2e504f1890fab740373cff7fdc5a11240fdfd506c16cfa0e0f5a6104fe706d02d89678c31c8cae9e4fd510
SSDEEP

384:fuOo+SMS8Sn16d/s16JijVAJ9OSU5RCn3I3k4L1oPunRz+eV5pK/F23aKVed+NUo:mOoKSBL1oP6Rz+Enfdh9YL8oPby

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1412	1368	cmd.exe	85
PID 1368 wrote to memory of 1412	1368	cmd.exe	85
PID 1412 wrote to memory of 1936	1412	cmd.exe	86
PID 1412 wrote to memory of 1936	1412	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\memenite-master\Run me.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "findstr /b /c:":menu_" "C:\Users\Admin\AppData\Local\Temp\memenite-master\Run me.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\system32\findstr.exe
    findstr /b /c:":menu_" "C:\Users\Admin\AppData\Local\Temp\memenite-master\Run me.bat"
    3⤵
    PID:1936