5175d28edc37244a54919522ea74ff3c9805e336a4a1b8ee5d9ed4bb3e8dbb16

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 09:20

Target

build.bat
Size

153B
MD5

5f5a4c156301e95a6721fbf77ff90ea9
SHA1

a32783b93b36535ca19419dcae1b395337cd40bf
SHA256

13703b199aa3cbc9e79835a3b822949cfae3949961a4a63b614799dd79ffc317
SHA512

e28e45fc72ae56bac2890653e63f8c8b69635e766435544320d221fd87e38ce04ac85b6c5295f37451e8403cdaa0ba7c3f1870b491bdc5aa392d5f042e03d821

Score

1^/10

Suspicious behavior: CmdExeWriteProcessMemorySpam 4 IoCs

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2192	2084	cmd.exe	31
PID 2084 wrote to memory of 2192	2084	cmd.exe	31
PID 2084 wrote to memory of 2192	2084	cmd.exe	31
PID 2084 wrote to memory of 2192	2084	cmd.exe	31
PID 2084 wrote to memory of 2152	2084	cmd.exe	32
PID 2084 wrote to memory of 2152	2084	cmd.exe	32
PID 2084 wrote to memory of 2152	2084	cmd.exe	32
PID 2084 wrote to memory of 2152	2084	cmd.exe	32
PID 2084 wrote to memory of 2140	2084	cmd.exe	33
PID 2084 wrote to memory of 2140	2084	cmd.exe	33
PID 2084 wrote to memory of 2140	2084	cmd.exe	33
PID 2084 wrote to memory of 2140	2084	cmd.exe	33
PID 2084 wrote to memory of 2120	2084	cmd.exe	34
PID 2084 wrote to memory of 2120	2084	cmd.exe	34
PID 2084 wrote to memory of 2120	2084	cmd.exe	34
PID 2084 wrote to memory of 2120	2084	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\hash.EXE
  hash
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\binpack.exe
  binpack.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2152
- C:\Users\Admin\AppData\Local\Temp\image.EXE
  image
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2140
- C:\Users\Admin\AppData\Local\Temp\bin2inch.exe
  bin2inch.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2120