e44229e925d7bcb00773fba75910ea74f5470627a68431f157b24413faae94c5

Analysis

max time kernel
91s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 19:40

Target

MAS_1.4_AIO_CRC32_9A7B5B05.cmd
Size

2.3MB
MD5

35f17dcf189ff654276cbd3777c474c5
SHA1

d0106953bb6026d874ca5f09fdec59e57b483b36
SHA256

e44229e925d7bcb00773fba75910ea74f5470627a68431f157b24413faae94c5
SHA512

dfcccbe815da154d9059bed85dc1740b360a8196f7005e61655d0677e1341d930d60ed24f347dd65fbf97c0baca305303d75edd76be421d126db2ead3b6ba8aa
SSDEEP

49152:g+ay1I0JxlXsyZ6tmDbR56nAfl5P/r/SI:rp/eyZ6tmDlTfbX

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 816	1264	cmd.exe	86
PID 1264 wrote to memory of 816	1264	cmd.exe	86
PID 1264 wrote to memory of 2392	1264	cmd.exe	87
PID 1264 wrote to memory of 2392	1264	cmd.exe	87
PID 1264 wrote to memory of 1748	1264	cmd.exe	88
PID 1264 wrote to memory of 1748	1264	cmd.exe	88
PID 1264 wrote to memory of 1400	1264	cmd.exe	89
PID 1264 wrote to memory of 1400	1264	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_1.4_AIO_CRC32_9A7B5B05.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:816
- C:\Windows\system32\reg.exe
  reg query HKU\S-1-5-19
  2⤵
  PID:2392
- C:\Windows\system32\mode.com
  mode con cols=98 lines=30
  2⤵
  PID:1748
- C:\Windows\system32\choice.exe
  choice /C:123456789 /N /M "> Enter Your Choice in the Keyboard [1,2,3,4,5,6,7,8,9] : "
  2⤵
  PID:1400