a9f0859a42a7d8a2ae883559cb72bf9f0817c4e6a758999bf885f1587eb0268b

Resubmissions

03-02-2024 17:14

240203-vr6d9sgfdl 1

03-02-2024 17:09

240203-vphkeseca3 4

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test_____.bat
Size

1KB
MD5

a2a44b76c9d5b262340efcdcd5b5f3c9
SHA1

5ad567f529aa1d307ba434b1c60028fdd4267e87
SHA256

a9f0859a42a7d8a2ae883559cb72bf9f0817c4e6a758999bf885f1587eb0268b
SHA512

db8ba1aa8f9eea3d3800a3722c052bd2d8f1d48e063da926c2b2d11856c1275e232dfcf02631dae0d2f35585a14dbd91aa6c13f7821a58756c37146acd02c7ec

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 880	2724	cmd.exe	49
PID 2724 wrote to memory of 880	2724	cmd.exe	49
PID 2724 wrote to memory of 880	2724	cmd.exe	49
PID 2724 wrote to memory of 2164	2724	cmd.exe	48
PID 2724 wrote to memory of 2164	2724	cmd.exe	48
PID 2724 wrote to memory of 2164	2724	cmd.exe	48
PID 2724 wrote to memory of 2176	2724	cmd.exe	29
PID 2724 wrote to memory of 2176	2724	cmd.exe	29
PID 2724 wrote to memory of 2176	2724	cmd.exe	29
PID 2724 wrote to memory of 2388	2724	cmd.exe	30
PID 2724 wrote to memory of 2388	2724	cmd.exe	30
PID 2724 wrote to memory of 2388	2724	cmd.exe	30
PID 2724 wrote to memory of 2356	2724	cmd.exe	47
PID 2724 wrote to memory of 2356	2724	cmd.exe	47
PID 2724 wrote to memory of 2356	2724	cmd.exe	47
PID 2724 wrote to memory of 2364	2724	cmd.exe	31
PID 2724 wrote to memory of 2364	2724	cmd.exe	31
PID 2724 wrote to memory of 2364	2724	cmd.exe	31
PID 2724 wrote to memory of 2860	2724	cmd.exe	32
PID 2724 wrote to memory of 2860	2724	cmd.exe	32
PID 2724 wrote to memory of 2860	2724	cmd.exe	32
PID 2724 wrote to memory of 2872	2724	cmd.exe	46
PID 2724 wrote to memory of 2872	2724	cmd.exe	46
PID 2724 wrote to memory of 2872	2724	cmd.exe	46
PID 2724 wrote to memory of 2876	2724	cmd.exe	45
PID 2724 wrote to memory of 2876	2724	cmd.exe	45
PID 2724 wrote to memory of 2876	2724	cmd.exe	45
PID 2724 wrote to memory of 2916	2724	cmd.exe	44
PID 2724 wrote to memory of 2916	2724	cmd.exe	44
PID 2724 wrote to memory of 2916	2724	cmd.exe	44
PID 2724 wrote to memory of 2932	2724	cmd.exe	43
PID 2724 wrote to memory of 2932	2724	cmd.exe	43
PID 2724 wrote to memory of 2932	2724	cmd.exe	43
PID 2724 wrote to memory of 2340	2724	cmd.exe	42
PID 2724 wrote to memory of 2340	2724	cmd.exe	42
PID 2724 wrote to memory of 2340	2724	cmd.exe	42
PID 2724 wrote to memory of 1884	2724	cmd.exe	33
PID 2724 wrote to memory of 1884	2724	cmd.exe	33
PID 2724 wrote to memory of 1884	2724	cmd.exe	33
PID 2724 wrote to memory of 2928	2724	cmd.exe	41
PID 2724 wrote to memory of 2928	2724	cmd.exe	41
PID 2724 wrote to memory of 2928	2724	cmd.exe	41
PID 2724 wrote to memory of 2132	2724	cmd.exe	40
PID 2724 wrote to memory of 2132	2724	cmd.exe	40
PID 2724 wrote to memory of 2132	2724	cmd.exe	40
PID 2724 wrote to memory of 1960	2724	cmd.exe	39
PID 2724 wrote to memory of 1960	2724	cmd.exe	39
PID 2724 wrote to memory of 1960	2724	cmd.exe	39
PID 2724 wrote to memory of 2568	2724	cmd.exe	38
PID 2724 wrote to memory of 2568	2724	cmd.exe	38
PID 2724 wrote to memory of 2568	2724	cmd.exe	38
PID 2724 wrote to memory of 2588	2724	cmd.exe	37
PID 2724 wrote to memory of 2588	2724	cmd.exe	37
PID 2724 wrote to memory of 2588	2724	cmd.exe	37
PID 2724 wrote to memory of 2652	2724	cmd.exe	36
PID 2724 wrote to memory of 2652	2724	cmd.exe	36
PID 2724 wrote to memory of 2652	2724	cmd.exe	36
PID 2724 wrote to memory of 2660	2724	cmd.exe	35
PID 2724 wrote to memory of 2660	2724	cmd.exe	35
PID 2724 wrote to memory of 2660	2724	cmd.exe	35
PID 2724 wrote to memory of 2668	2724	cmd.exe	34
PID 2724 wrote to memory of 2668	2724	cmd.exe	34
PID 2724 wrote to memory of 2668	2724	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2176
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2388
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2364
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2860
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:1884
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2668
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2660
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2652
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2588
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2568
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:1960
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2132
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2928
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2340
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2932
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2916
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2876
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2872
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2356
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:2164
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\test_____.bat"
  2⤵
  PID:880

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads