d5c3971bc68e05f1902bca8c6bb07fb179c7130370486bef310d9b7fa5e212bf

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 07:48

Target

test.bat
Size

5KB
MD5

bf2e2de0bbdf899b68c77344755eff6c
SHA1

41b137c3a162388b24841b8ed01d03a9f4bc4671
SHA256

d5c3971bc68e05f1902bca8c6bb07fb179c7130370486bef310d9b7fa5e212bf
SHA512

02cb243f0fbd911377012bd19b061c9e9b831c84a33123158309a2b91ea8dcd7bd88152bb7dbdd298590d49244733738cd2d5bf88cb1be1850245bac657ce68e
SSDEEP

96:U/FOIz23YEQpLuLpDqUmDsYW0LGMJi7sJEJxaJeJdHLgLxkp/FOIz23YEQpLuLp8:G23YEQpLuLpDq7QYfLGMV+jasHHLgLxK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2140	2420	cmd.exe	29
PID 2420 wrote to memory of 2140	2420	cmd.exe	29
PID 2420 wrote to memory of 2140	2420	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2140