9f5d87d067897c87e6258fe30b382586126dcedaa9a517357d393d81b0805ba7 | Triage

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 15:39

Sharing

Report Analysis Logs

General

Target

adb-fastboot/打开CMD命令行.bat
Size

1KB
MD5

cc73d02870f497caa025d54f36fabbde
SHA1

71dd72616c9cc415c5a2600c740627f97f602689
SHA256

4963b7922eb8ce1a83e15dd020a4cc2746373c30048c3df2b080880bd7b27669
SHA512

9331a91668455a7eabf949f69618adeef98a1fca54ada5d1931b4170cf6a0022b20d6bf4b86e4ac95c77eb0ba252577bc4a28c26123f5a4df3a94e14242310f8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 1576	3192	cmd.exe	84
PID 3192 wrote to memory of 1576	3192	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\adb-fastboot\打开CMD命令行.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\system32\cmd.exe
  cmd /k
  2⤵
  PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads