02d3b89a95b85e771778e723adf7d9bba0509047d00f43fc2e9f26188c88a16a | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 16:16

Sharing

Report Analysis Logs

General

Target

UnBan Guide/step 3/Change Disk IDs.cmd
Size

1KB
MD5

6346b33980b7d8946c1f0dba5cbfd7f9
SHA1

c42c97f649afa4b408d25e003277f89b4cdbe7d8
SHA256

282932d8caacf613b7167f674a84d320af5b9e253f21c8134c46ce25ff4bb07b
SHA512

bef23ec08e2e9623a1b8769c509726e36e8d91b23593d59f38a3c7848ea6d07b963728a33ba74cde6da27f1944ca06ed4dd58eed4c7456c0e5c942ae227c2320

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2056	2976	cmd.exe	29
PID 2976 wrote to memory of 2056	2976	cmd.exe	29
PID 2976 wrote to memory of 2056	2976	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 3\Change Disk IDs.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\fsutil.exe
  fsutil fsinfo drives
  2⤵
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads