f28a51b11bd5a184a2415a5243ee65b31a19109e61acc50a14c174a613fe4938

Analysis

max time kernel
105s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 22:41

Target

Malware-master/Shutdowns.bat
Size

417B
MD5

a3e8189bb7412c7a3e8a5eb5b4fb224d
SHA1

da416ef101e691c37aca415194aa02cfe8e45083
SHA256

f57891da6fdbe01e19a92c74bb564fdffc8bbb76df2feeeb94c5c683b453304c
SHA512

7a570dee22b0d34991ea6e9b7c80e49165d806dffb2e42729e784e3bf640e841f034763a7c40be2018eaa885068669c58c6688d30e6d7b93e3a8949fb920b6e9

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4692	1180	cmd.exe	86
PID 1180 wrote to memory of 4692	1180	cmd.exe	86
PID 1180 wrote to memory of 3076	1180	cmd.exe	87
PID 1180 wrote to memory of 3076	1180	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Malware-master\Shutdowns.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\system32\reg.exe
  reg add hkey_local_machinesoftwaremicrosoftwindowscurrentv ersionrun /v startAPI /t reg_sz /d c:windowshartlell.bat /f
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg add hkey_current_usersoftwaremicrosoftwindowscurrentve rsionrun /v /t reg_sz /d c:windowshartlell.bat /f
  2⤵
  PID:3076