f0e14777df414adca02f5bc411675664bec7b2348a6710113aabaff9a592e6ed

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:35

Target

update.cmd
Size

1KB
MD5

f82ed0d36d76909d586cca6965b6df07
SHA1

17ab6836e86dda0db9209747ba1c7bd78a818e15
SHA256

f0e14777df414adca02f5bc411675664bec7b2348a6710113aabaff9a592e6ed
SHA512

e794fae26290a38ddd5f9dfc66e4c62e1e928a92b982c1315b759f25b3c2e10ef649ba021a3e4a895925cd1e8c4e43748172b4976c971ce5057ecb017fc421a0

Score

1^/10

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2108	2704	cmd.exe	29
PID 2704 wrote to memory of 2108	2704	cmd.exe	29
PID 2704 wrote to memory of 2108	2704	cmd.exe	29
PID 2108 wrote to memory of 2268	2108	cmd.exe	31
PID 2108 wrote to memory of 2268	2108	cmd.exe	31
PID 2108 wrote to memory of 2268	2108	cmd.exe	31
PID 2108 wrote to memory of 2272	2108	cmd.exe	32
PID 2108 wrote to memory of 2272	2108	cmd.exe	32
PID 2108 wrote to memory of 2272	2108	cmd.exe	32
PID 2108 wrote to memory of 2308	2108	cmd.exe	33
PID 2108 wrote to memory of 2308	2108	cmd.exe	33
PID 2108 wrote to memory of 2308	2108	cmd.exe	33
PID 2108 wrote to memory of 2116	2108	cmd.exe	35
PID 2108 wrote to memory of 2116	2108	cmd.exe	35
PID 2108 wrote to memory of 2116	2108	cmd.exe	35
PID 2108 wrote to memory of 2012	2108	cmd.exe	36
PID 2108 wrote to memory of 2012	2108	cmd.exe	36
PID 2108 wrote to memory of 2012	2108	cmd.exe	36
PID 2108 wrote to memory of 1720	2108	cmd.exe	37
PID 2108 wrote to memory of 1720	2108	cmd.exe	37
PID 2108 wrote to memory of 1720	2108	cmd.exe	37
PID 2108 wrote to memory of 2188	2108	cmd.exe	38
PID 2108 wrote to memory of 2188	2108	cmd.exe	38
PID 2108 wrote to memory of 2188	2108	cmd.exe	38
PID 2108 wrote to memory of 1960	2108	cmd.exe	39
PID 2108 wrote to memory of 1960	2108	cmd.exe	39
PID 2108 wrote to memory of 1960	2108	cmd.exe	39

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\update.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\update.cmd" MY_FLAG
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\kam.cmd""
    3⤵
    PID:2268
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\las.cmd""
    3⤵
    PID:2272
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\zap.cmd""
    3⤵
    PID:2308
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\sample.cmd""
    3⤵
    PID:2116
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\xff.cmd""
    3⤵
    PID:2012
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\time.cmd""
    3⤵
    PID:1720
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\upload.cmd""
    3⤵
    PID:2188
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\update.cmd""
    3⤵
    PID:1960