f3ea29a2811f839ca72b82e3ccf19bdb83ec25818cbe16e61a6f2f152436a03d | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 06:26

Sharing

Report Analysis Logs

General

Target

start.bat
Size

388B
MD5

c6171dfd929b6b760457dd1191611833
SHA1

a713d9dc6347a94613a0d8cbd3d949a08fe21779
SHA256

f3caba3083a8bc66b652065480fc1b8c25ddc80e07bd5048082d784fcc9cecc8
SHA512

c0346f9d1e900b47a9d6992f930edbd4203a5d5c44f43183b97e36f1bc1ea6801dedf0fbaf51583f9e1f813a0410a0661cf0e5c00da7042af02cf2488512c091

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2428	2128	cmd.exe	84
PID 2128 wrote to memory of 2428	2128	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar jsocks.jar
  2⤵
  PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-2-0x0000022B80000000-0x0000022B80270000-memory.dmp

Filesize
2.4MB

Download
memory/2428-11-0x0000022BF50C0000-0x0000022BF50C1000-memory.dmp

Filesize
4KB

Download
memory/2428-13-0x0000022B80000000-0x0000022B80270000-memory.dmp

Filesize
2.4MB

Download