ba66b79ee30d7987deed54ef865df61d324bcd4a6d82782d8a7d2f96a9821c87 | Triage

Analysis

max time kernel
458s
max time network
488s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
09/06/2024, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

minecraftportable-main/server/001/start.bat
Size

62B
MD5

841f74c443b4ea29f734dab8b81b1a29
SHA1

ea237e5f1e662a45e75b7c794865d1142c61d513
SHA256

2d92c27253aa94e347a931795952b9aa8ecd926f7d60d201447ef6eefd5dd38f
SHA512

7b1763577176ccfe0f530ebc4698676bc02b1da54453ca960a58d71a5244a47ab3c74e706e75c6119b26c037dec4a24ae9b6f0f174dde426d15f2662a7f23f17

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3348	3724	cmd.exe	79
PID 3724 wrote to memory of 3348	3724	cmd.exe	79

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\minecraftportable-main\server\001\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -Xmx1024M -Xms1024M -jar server.jar nogui
  2⤵
  PID:3348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads