f28a51b11bd5a184a2415a5243ee65b31a19109e61acc50a14c174a613fe4938

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 22:41

Target

Malware-master/Shutdowns.bat
Size

417B
MD5

a3e8189bb7412c7a3e8a5eb5b4fb224d
SHA1

da416ef101e691c37aca415194aa02cfe8e45083
SHA256

f57891da6fdbe01e19a92c74bb564fdffc8bbb76df2feeeb94c5c683b453304c
SHA512

7a570dee22b0d34991ea6e9b7c80e49165d806dffb2e42729e784e3bf640e841f034763a7c40be2018eaa885068669c58c6688d30e6d7b93e3a8949fb920b6e9

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2864	2736	cmd.exe	29
PID 2736 wrote to memory of 2864	2736	cmd.exe	29
PID 2736 wrote to memory of 2864	2736	cmd.exe	29
PID 2736 wrote to memory of 2896	2736	cmd.exe	30
PID 2736 wrote to memory of 2896	2736	cmd.exe	30
PID 2736 wrote to memory of 2896	2736	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Malware-master\Shutdowns.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\reg.exe
  reg add hkey_local_machinesoftwaremicrosoftwindowscurrentv ersionrun /v startAPI /t reg_sz /d c:windowshartlell.bat /f
  2⤵
  PID:2864
- C:\Windows\system32\reg.exe
  reg add hkey_current_usersoftwaremicrosoftwindowscurrentve rsionrun /v /t reg_sz /d c:windowshartlell.bat /f
  2⤵
  PID:2896