9f5d87d067897c87e6258fe30b382586126dcedaa9a517357d393d81b0805ba7 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 15:39

Sharing

Report Analysis Logs

General

Target

adb-fastboot/打开CMD命令行.bat
Size

1KB
MD5

cc73d02870f497caa025d54f36fabbde
SHA1

71dd72616c9cc415c5a2600c740627f97f602689
SHA256

4963b7922eb8ce1a83e15dd020a4cc2746373c30048c3df2b080880bd7b27669
SHA512

9331a91668455a7eabf949f69618adeef98a1fca54ada5d1931b4170cf6a0022b20d6bf4b86e4ac95c77eb0ba252577bc4a28c26123f5a4df3a94e14242310f8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2720	1728	cmd.exe	29
PID 1728 wrote to memory of 2720	1728	cmd.exe	29
PID 1728 wrote to memory of 2720	1728	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\adb-fastboot\打开CMD命令行.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\cmd.exe
  cmd /k
  2⤵
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads