b0db11cb8d232f65a27118734a477a2b3d3f0d5e8170f966ba82309cd437c114 | Triage

Analysis

max time kernel
131s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 11:47

Sharing

Report Analysis Logs

General

Target

AVG Anti-Spyware/1)uninstall.bat
Size

129B
MD5

5021c3c0080a1afa60fb66f63be728b0
SHA1

52754ce82fcf7a0f77ec9427d5bb932682b08c8d
SHA256

e861f828e1b20507ca12960709cfe5d4fa61a781aca5933dd99e6f690e4595da
SHA512

076564ef3039a9d5fa69fe0dff8fefc204b24ad77d6e889d795fc72041438f4af09e8bb057e2e7eb648354610b7c31ea0b00d7a4ac81b5fd7f83a15f54fe82bf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 668	3272	cmd.exe	91
PID 3272 wrote to memory of 668	3272	cmd.exe	91
PID 3272 wrote to memory of 668	3272	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\1)uninstall.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\guard.exe
  guard /uninstall
  2⤵
  PID:668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1324,i,6041070687820623968,3004230300437737550,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
1⤵
PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads