0fb7388c69ef9d2d892e6edc7eff8c86ce6f6659c88d347234acaa1a382e22ba | Triage

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 18:34

Sharing

Report Analysis Logs

General

Target

hey/twelfth.bat
Size

1KB
MD5

4e7c3ec7e4db2756209f5190355c3716
SHA1

183a6caaba0208f8bdfe3bf7e25f069ecddf19f5
SHA256

f2178583f6008d7ade32bb218bcd5d846859ce059875b4f603e18be57a59c7a8
SHA512

d3f3ddef38d17b9b2ac209719d6bcc83d13053abc9a97e4055f1b899fbfdba054317a5c94e2a688637b18440adb120065a89a7de5ae6b84ef7b91b8922bdd768

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4588 wrote to memory of 4032 4588 cmd.exe xcopy.exe
PID 4588 wrote to memory of 4032 4588 cmd.exe xcopy.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hey\twelfth.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\system32\xcopy.exe
  xcopy /s /i /e /h hey\superstring.dll C:\Users\Admin\AppData\Local\Temp\*
  2⤵
  PID:4032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads