6f78a9ec4dde9902a9eafe74d46d3807c1807323202ae51f54bf1c3874bbac77 | Triage

Analysis

max time kernel
841s
max time network
853s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-03-2024 23:04

Sharing

Report Analysis Logs

General

Target

sss/Install/Del3.bat
Size

217B
MD5

fb369c6af5023aff988430d0c66b7d53
SHA1

8c7395e08476c5b26a17acb1d0c6cff80bc4024a
SHA256

09d17906e4af64f008c7f0136ad1609467925bc5b9a2adf67c806b95fd7a7302
SHA512

419d97314c76ddfaf826ba4ecf52932e5f93c97d99b7286ab71477cef3d7c37cb91d6d7c528d4caca465e42a2471b7022259e969e8ca96c63c76f043ab425ed9

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

pid	Process
1684	timeout.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1684	2756	cmd.exe	29
PID 2756 wrote to memory of 1684	2756	cmd.exe	29
PID 2756 wrote to memory of 1684	2756	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\sss\Install\Del3.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads