67001c8f5a37c1ccd2d1750f21e28d372a8639c330aafbae111a5956c942b71a | Triage

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 09:30

Sharing

Report Analysis Logs

General

Target

driver/vista/install_silent.bat
Size

17B
MD5

262b5c4496a902ebe2e5659b763766c4
SHA1

2dfcbd32ec44e0e15628cfeda38d9d5ca4df0ab8
SHA256

15af5763e85b2250dd1d00ed3ab051a69f3dd00cd679f7646ff34f18ed867476
SHA512

c7ff7eba5a3e9c49cadaefb7f1c608871dcfca2b38e0befbe6335eb0559043ba901331337282e3fbf318135fc9a22ed7100f645e0185327e01fc2fb1fd783795

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2288	setupdrv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2288	2736	cmd.exe	29
PID 2736 wrote to memory of 2288	2736	cmd.exe	29
PID 2736 wrote to memory of 2288	2736	cmd.exe	29
PID 2736 wrote to memory of 2288	2736	cmd.exe	29
PID 2736 wrote to memory of 2288	2736	cmd.exe	29
PID 2736 wrote to memory of 2288	2736	cmd.exe	29
PID 2736 wrote to memory of 2288	2736	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\driver\vista\install_silent.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\driver\vista\setupdrv.exe
  setupdrv installs
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads