be0b5318d28784df090e1bab91d1cd7f76cfc0dae740ce2199aa07d83e25267e | Triage

Analysis

max time kernel
533s
max time network
548s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
11-06-2024 10:00

Sharing

Report Analysis Logs

General

Target

Bypass/install.bat
Size

715B
MD5

14741a4d4fb83a66aad98699db84cf7f
SHA1

6b4c747e267a5a67cbedf5daa67b017adf6eacef
SHA256

3ce14bbce42e339769dae4ec3ffd8b5150884e159366fbb88699203e76048664
SHA512

e28b4309bd985aa7f4ef497ba4ebbe70d4b5914eea0b8e14b8ccc396c08e4060a760e689f533234575998d4abe9af20fd44bdd2e5a87bfd374f2b9c82cdbbac3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2924 wrote to memory of 1516	2924	cmd.exe	AppInstallerPythonRedirector.exe
PID 2924 wrote to memory of 1516	2924	cmd.exe	AppInstallerPythonRedirector.exe
PID 2924 wrote to memory of 1516	2924	cmd.exe	AppInstallerPythonRedirector.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Bypass\install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python bypass.py
  2⤵
  PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads