c281b1d9b9d1f59fbde5d9042295fce56f7d4040fb3ef6fc389f0a49d5c53eac

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-02-2024 15:41

Target

Launch.bat
Size

19KB
MD5

87739439d2217d83e15f1389549e41c9
SHA1

567be03f8cf4425de8e1e5c274efc959d54ca231
SHA256

c281b1d9b9d1f59fbde5d9042295fce56f7d4040fb3ef6fc389f0a49d5c53eac
SHA512

bcae0632fecb4ab8a4a4715d022eb800020361e930102310c5631c7bdf28ddcaf382084bc20b64b9094cd9d68383b9e3db5ab9aec993181b74e1a4635f342254
SSDEEP

384:UHpBGx8L4FUsPEBcM+6Rdi5jsTnE7H8r2:WpBGx88FUsPf6Rg5j4EHB

Score

1^/10

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 904	2012	cmd.exe	29
PID 2012 wrote to memory of 904	2012	cmd.exe	29
PID 2012 wrote to memory of 904	2012	cmd.exe	29
PID 2012 wrote to memory of 1744	2012	cmd.exe	31
PID 2012 wrote to memory of 1744	2012	cmd.exe	31
PID 2012 wrote to memory of 1744	2012	cmd.exe	31
PID 2012 wrote to memory of 2176	2012	cmd.exe	30
PID 2012 wrote to memory of 2176	2012	cmd.exe	30
PID 2012 wrote to memory of 2176	2012	cmd.exe	30
PID 2012 wrote to memory of 2736	2012	cmd.exe	32
PID 2012 wrote to memory of 2736	2012	cmd.exe	32
PID 2012 wrote to memory of 2736	2012	cmd.exe	32
PID 2012 wrote to memory of 2636	2012	cmd.exe	33
PID 2012 wrote to memory of 2636	2012	cmd.exe	33
PID 2012 wrote to memory of 2636	2012	cmd.exe	33
PID 2012 wrote to memory of 2400	2012	cmd.exe	36
PID 2012 wrote to memory of 2400	2012	cmd.exe	36
PID 2012 wrote to memory of 2400	2012	cmd.exe	36
PID 2012 wrote to memory of 2096	2012	cmd.exe	35
PID 2012 wrote to memory of 2096	2012	cmd.exe	35
PID 2012 wrote to memory of 2096	2012	cmd.exe	35
PID 2012 wrote to memory of 3060	2012	cmd.exe	34
PID 2012 wrote to memory of 3060	2012	cmd.exe	34
PID 2012 wrote to memory of 3060	2012	cmd.exe	34
PID 2012 wrote to memory of 3000	2012	cmd.exe	37
PID 2012 wrote to memory of 3000	2012	cmd.exe	37
PID 2012 wrote to memory of 3000	2012	cmd.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Launch.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\chcp.com
  chcp.com 437
  2⤵
  PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type tmp
  2⤵
  PID:2176
- C:\Windows\system32\find.exe
  find
  2⤵
  PID:1744
- C:\Windows\system32\find.exe
  find
  2⤵
  PID:2736
- C:\Windows\system32\findstr.exe
  findstr /L /I set C:\Users\Admin\AppData\Local\Temp\Launch.bat
  2⤵
  PID:2636
- C:\Windows\system32\findstr.exe
  findstr /L /I pause C:\Users\Admin\AppData\Local\Temp\Launch.bat
  2⤵
  PID:3060
- C:\Windows\system32\findstr.exe
  findstr /L /I echo C:\Users\Admin\AppData\Local\Temp\Launch.bat
  2⤵
  PID:2096
- C:\Windows\system32\findstr.exe
  findstr /L /I goto C:\Users\Admin\AppData\Local\Temp\Launch.bat
  2⤵
  PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type tmp
  2⤵
  PID:3000

C:\Users\Admin\AppData\Local\Temp\tmp

Filesize
14B

MD5
ce585c6ba32ac17652d2345118536f9c

SHA1
be0e41b3690c42e4c0cdb53d53fc544fb46b758d

SHA256
589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3

SHA512
d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752

Download Submit