07b08528b1bffffe03b6f8a347156cf114ae1ff0c9bd18cc2d2c7b28b97434de

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 15:33

Target

env-fix_1_1.bat
Size

815B
MD5

b6fe6ea789cfb4b3f4e5d5159d4eddb7
SHA1

2cf6427b2eda14c106449901dc99f59a199be6b4
SHA256

07b08528b1bffffe03b6f8a347156cf114ae1ff0c9bd18cc2d2c7b28b97434de
SHA512

8c280db72ae51bbfd8bcd16d866bee70980d0a79b6cd9b6e5dca969c2e21f940c2901a2148d11187466c2360492d60e558972449a35e53b59a5b3600811f4675

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 3904	4900	cmd.exe	91
PID 4900 wrote to memory of 3904	4900	cmd.exe	91
PID 3904 wrote to memory of 532	3904	net.exe	92
PID 3904 wrote to memory of 532	3904	net.exe	92
PID 4900 wrote to memory of 3108	4900	cmd.exe	93
PID 4900 wrote to memory of 3108	4900	cmd.exe	93
PID 4900 wrote to memory of 5056	4900	cmd.exe	94
PID 4900 wrote to memory of 5056	4900	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\env-fix_1_1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c set OPENSSL_ia32cap
  2⤵
  PID:3108
- C:\Windows\system32\setx.exe
  setx OPENSSL_ia32cap ~0x20000000
  2⤵
  PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:232