7e920f57ec7172fdd2d2df6c0c4102e37c673b603f65ca84fa5c100ec3fff7a2

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 04:41

Target

WINPG_V4_279/WINPG32_IOCTL.bat
Size

210B
MD5

bfcac971b7f83cb76862b2589d5ef79f
SHA1

783815a96b5bf2287aea273b9fe98b18e15b30f0
SHA256

a182f9643120fc05aaa4e896b823b55889c55fbf9b459850ae8e90a207d3c5cb
SHA512

9108a7898e364249541db29faa7f0db52c71c233b429cfac570565788631cdb69a71efd031efccb9564be1830e4998bf53428e1d8d7d5d62d4848db01a60d77b

Score

1^/10

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2356	RTNicPgW32.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2888	2164	cmd.exe	29
PID 2164 wrote to memory of 2888	2164	cmd.exe	29
PID 2164 wrote to memory of 2888	2164	cmd.exe	29
PID 2888 wrote to memory of 2980	2888	net.exe	30
PID 2888 wrote to memory of 2980	2888	net.exe	30
PID 2888 wrote to memory of 2980	2888	net.exe	30
PID 2164 wrote to memory of 2356	2164	cmd.exe	31
PID 2164 wrote to memory of 2356	2164	cmd.exe	31
PID 2164 wrote to memory of 2356	2164	cmd.exe	31
PID 2164 wrote to memory of 2356	2164	cmd.exe	31
PID 2164 wrote to memory of 2448	2164	cmd.exe	32
PID 2164 wrote to memory of 2448	2164	cmd.exe	32
PID 2164 wrote to memory of 2448	2164	cmd.exe	32
PID 2448 wrote to memory of 1996	2448	net.exe	33
PID 2448 wrote to memory of 1996	2448	net.exe	33
PID 2448 wrote to memory of 1996	2448	net.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\WINPG_V4_279\WINPG32_IOCTL.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\system32\net.exe
  net stop DashClientService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop DashClientService
    3⤵
    PID:2980
- C:\Users\Admin\AppData\Local\Temp\WINPG_V4_279\RTNicPgW32.exe
  RTNicPgW32.exe /wpgioctl /eeprom /r
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2356
- C:\Windows\system32\net.exe
  net start DashClientService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start DashClientService
    3⤵
    PID:1996