d453f0e745c8ea0ff5d918d0358662dec10af3b8cef3061e445ec87aca4cd8fe

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 00:07

Target
sourceCode\cleartrack\ClearTrack.bat
Size 577B
Sample240528-aee2bsfb31
SHA256 22aa094891ad110c9ec7cb143ea18a5b60f22af3e440081223c26e24e885ad60
MD5 fa2c85c6ba7d10a910c3b2d0870bb79e
SHA1 3fc5b53360b665800bd98ff284b1a18a16bc66bb
SHA512 9c4bb85be39d20ef9547631fda759669cc52cb4154183389cfd6a6b80fb5bc5e18dd42877e31653b8779ce9851c7499b51066276500b10a1ae75841f6f9fc33b
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2964	2100	cmd.exe	29
PID 2100 wrote to memory of 2964	2100	cmd.exe	29
PID 2100 wrote to memory of 2964	2100	cmd.exe	29
PID 2964 wrote to memory of 1244	2964	cmd.exe	30
PID 2964 wrote to memory of 1244	2964	cmd.exe	30
PID 2964 wrote to memory of 1244	2964	cmd.exe	30
PID 2964 wrote to memory of 2208	2964	cmd.exe	31
PID 2964 wrote to memory of 2208	2964	cmd.exe	31
PID 2964 wrote to memory of 2208	2964	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\sourceCode\cleartrack\ClearTrack.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment" /s | findstr /i /r /c:"^ * InstallDir"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment" /s
    3⤵
    PID:1244
- - C:\Windows\system32\findstr.exe
    findstr /i /r /c:"^ * InstallDir"
    3⤵
    PID:2208