c6527d8372e26cb77ee6cd95c5965d3a875e177bb8192b97a292ccae74293c82

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 22:08

Target

Fake_IP_Puller.bat
Size

2KB
MD5

7868a29f8084bc27e6c998755d6b89a4
SHA1

34aefe54b52c3ba3b383cccabcaa1b59d766b891
SHA256

c6527d8372e26cb77ee6cd95c5965d3a875e177bb8192b97a292ccae74293c82
SHA512

e6ac72482b654056e0d84c16bb0f958385280af44eb470d721fcdd913b5a3ded519ca13c8a8738847dae616cceb38310d18d509d9dd9622f47f28115c63931ed

Score

1^/10

Delays execution with timeout.exe 3 IoCs

evasion

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3004	1500	cmd.exe	29
PID 1500 wrote to memory of 3004	1500	cmd.exe	29
PID 1500 wrote to memory of 3004	1500	cmd.exe	29
PID 1500 wrote to memory of 2680	1500	cmd.exe	30
PID 1500 wrote to memory of 2680	1500	cmd.exe	30
PID 1500 wrote to memory of 2680	1500	cmd.exe	30
PID 1500 wrote to memory of 3048	1500	cmd.exe	31
PID 1500 wrote to memory of 3048	1500	cmd.exe	31
PID 1500 wrote to memory of 3048	1500	cmd.exe	31
PID 1500 wrote to memory of 2500	1500	cmd.exe	34
PID 1500 wrote to memory of 2500	1500	cmd.exe	34
PID 1500 wrote to memory of 2500	1500	cmd.exe	34
PID 1500 wrote to memory of 2504	1500	cmd.exe	35
PID 1500 wrote to memory of 2504	1500	cmd.exe	35
PID 1500 wrote to memory of 2504	1500	cmd.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Fake_IP_Puller.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3004
- C:\Windows\system32\mode.com
  mode 120, 30
  2⤵
  PID:2680
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:3048
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:2500
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2504

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ip kurw.txt
1⤵
PID:2556

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ip kurw.txt
1⤵
PID:2468

C:\Users\Admin\Desktop\ip kurw.txt

Filesize
14B

MD5
860ff9092ffcd3a10902ca398b0e94c9

SHA1
785da83c53d124b37ce90f9543cf92e73586bd45

SHA256
82b134b62107f5e440a273e00d4c08f134fb9d55baa5a0a441092fdca4fe572c

SHA512
39d77c6221292d638c2cd0af1658731c7d306a021db8a2b781865861daa092fde958c878251f4890f2fc9af621e7612a1982985cc2a06474b18cf810fe268425

Download Submit