4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 11:50

Sharing

Report Analysis Logs

General

Target

driver/install.bat
Size

913B
MD5

e304283c4c158fed4e877bcf1c21df7d
SHA1

2991be31c6a1070acd7f2eea883c3ea2e91d1748
SHA256

931170d763dbbf046aac972d548a182c473957714db63d99133ae65240459916
SHA512

085a96602d5b055dcec3e57799ff89a8f1e3da89434be36e03592ca015ede060bdd4c05201da2126e4c60509f5508a49efe83ec2825a77dd496c6ec3e64be099

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1664	2352	cmd.exe	29
PID 2352 wrote to memory of 1664	2352	cmd.exe	29
PID 2352 wrote to memory of 1664	2352	cmd.exe	29
PID 2352 wrote to memory of 2896	2352	cmd.exe	30
PID 2352 wrote to memory of 2896	2352	cmd.exe	30
PID 2352 wrote to memory of 2896	2352	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\driver\install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:1664
- C:\Windows\system32\find.exe
  find "10.0"
  2⤵
  PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads