a85e26234f77ae94581122d3828fdcbc920ce9dc567385091481b98abd71239d | Triage™

Analysis

max time kernel
122s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
poop.bat
Size 31B
Sample240613-bh4drsscmr
SHA256 a85e26234f77ae94581122d3828fdcbc920ce9dc567385091481b98abd71239d
MD5 d1052c0b24aa3c0143ba7735cfc0bf68
SHA1 81a6f58afafe481172ef1384f2b8cd69f8b599b1
SHA512 10fcc724e93ea8ae5047de34f295bce1e80fadd28ad95225d7f16c8fc7d64cf7772b7ec7b72d7fee12a8999289ebfc72b7dd5e8aa63cf726f5f13feb1621f26c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 4524	3400	cmd.exe	83
PID 3400 wrote to memory of 4524	3400	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\poop.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\system32\curl.exe
  curl ascii.live/can-you-hear-me
  2⤵
  PID:4524

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads