4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf | Triage™

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
driver/install.bat
Size 913B
Sample240329-nzkdfagg89
SHA256 931170d763dbbf046aac972d548a182c473957714db63d99133ae65240459916
MD5 e304283c4c158fed4e877bcf1c21df7d
SHA1 2991be31c6a1070acd7f2eea883c3ea2e91d1748
SHA512 085a96602d5b055dcec3e57799ff89a8f1e3da89434be36e03592ca015ede060bdd4c05201da2126e4c60509f5508a49efe83ec2825a77dd496c6ec3e64be099
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1664	2352	cmd.exe	29
PID 2352 wrote to memory of 1664	2352	cmd.exe	29
PID 2352 wrote to memory of 1664	2352	cmd.exe	29
PID 2352 wrote to memory of 2896	2352	cmd.exe	30
PID 2352 wrote to memory of 2896	2352	cmd.exe	30
PID 2352 wrote to memory of 2896	2352	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\driver\install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:1664
- C:\Windows\system32\find.exe
  find "10.0"
  2⤵
  PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads