f646652723994218114d688def2e56f990a8efb100871b691b41ae4c41582176

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 22:30

Target
bin/ping.bat
Size 263B
Sample240605-2e4s8sag81
SHA256 e3154b30109f1cbd15de5a40e641105ab4b2d0f648abfc94c21fdb32ffc0fe6d
MD5 62a26811014559b839c885cd2ac31fa7
SHA1 b3fe62360fa6229b9d9da820c545d6c9fce8c215
SHA512 3f9b5fd6b40aea56077a2b55da0ac246d598070e2c10b3ec0a211375b1eddbcc39dded18fc68d73dc1146f2d01f37a882187eb624f20f0c639221c0c4f8b9ed2
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 320	1676	cmd.exe	29
PID 1676 wrote to memory of 320	1676	cmd.exe	29
PID 1676 wrote to memory of 320	1676	cmd.exe	29
PID 320 wrote to memory of 2572	320	java.exe	30
PID 320 wrote to memory of 2572	320	java.exe	30
PID 320 wrote to memory of 2572	320	java.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bin\ping.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\java.exe
  java -cp "C:\Users\Admin\AppData\Local\Temp"\nxd.jar;"C:\Users\Admin\AppData\Local\Temp"\lib\*; nxd.NxAdmin ping
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\system32\hostname.exe
    hostname
    3⤵
    PID:2572

memory/320-2-0x00000000024A0000-0x0000000002710000-memory.dmp

Download

memory/320-15-0x0000000000150000-0x0000000000151000-memory.dmp

Download

memory/320-16-0x00000000024A0000-0x0000000002710000-memory.dmp

Download