cab7b8973dd5f7252af6a1a080deec442acd1e6bdd6c7476bd73e39553751222 | Triage

Analysis

max time kernel
34s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 19:38

Sharing

Report Analysis Logs

General

Target

start.bat
Size

548B
MD5

12c37bf6537bfdf93b80c31f6d1391b2
SHA1

43df564e4988008f3e97167837f58f1452cf3d13
SHA256

cab7b8973dd5f7252af6a1a080deec442acd1e6bdd6c7476bd73e39553751222
SHA512

c59645da2377ec2eb8c4ca75174379134dc657741ee324fc6fd38170b9704852bf136a919fe0363ea85befe61e8838ef74dad07e365392d8f8f6462bb1ba75f9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1380	2460	cmd.exe	29
PID 2460 wrote to memory of 1380	2460	cmd.exe	29
PID 2460 wrote to memory of 1380	2460	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads