67001c8f5a37c1ccd2d1750f21e28d372a8639c330aafbae111a5956c942b71a | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 09:30

Sharing

Report Analysis Logs

General

Target

driver/vista/uninstall_silent.bat
Size

19B
MD5

a883f2e3804f157892c5a2a2c4fc1bcb
SHA1

5bedc101311e87d9798b75e3a54c95a84e168d14
SHA256

749527f0ed65353004a9a988029e38e89f1ec97fb400a3f26ec705280a95333f
SHA512

6fe1b2facae0bd50c23294547512d2f4ced56d4541d26053ef68ea1d5d98862ae5aab81c77a8601fa05945e3d608241e68e2b867bf88d3dad86fe80bbe403465

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1992	setupdrv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1992	1312	cmd.exe	29
PID 1312 wrote to memory of 1992	1312	cmd.exe	29
PID 1312 wrote to memory of 1992	1312	cmd.exe	29
PID 1312 wrote to memory of 1992	1312	cmd.exe	29
PID 1312 wrote to memory of 1992	1312	cmd.exe	29
PID 1312 wrote to memory of 1992	1312	cmd.exe	29
PID 1312 wrote to memory of 1992	1312	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\driver\vista\uninstall_silent.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\driver\vista\setupdrv.exe
  setupdrv uninstalls
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads