c3f250ab11d40bc8e68d90efa095da80a4e2c285d3d04e1c52434158345e2b47 | Triage

Analysis

max time kernel
46s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 08:59

Sharing

Report Analysis Logs

General

Target

CVE-2023-38831/script.bat
Size

9B
MD5

c61463921d79e07e461fd0e731f72619
SHA1

4c70ac1680d2c4bdb145d5be5dad5230b20805f2
SHA256

7fdf626e0603f5bc2375a7bbc92c94a21088841c0a03cf3c5f12aa9c680ce4e6
SHA512

1a0ada808250064beaafad6095f6d12b0a26ddeb0aff616205986dc4db7c4e72686701945bfb948a141a5f6db0d0e6cec29cd2fddc59ba07a9279a93a7e3541e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2908 wrote to memory of 2228	2908	cmd.exe	calc.exe
PID 2908 wrote to memory of 2228	2908	cmd.exe	calc.exe
PID 2908 wrote to memory of 2228	2908	cmd.exe	calc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CVE-2023-38831\script.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\system32\calc.exe
calc.exe
2⤵
PID:2228

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...