a0457d69830ac38f45f672e712b46a3ee2d57c504e251eca446c3f7b68cb8b8e | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 21:54

Sharing

Report Analysis Logs

General

Target

VisualBat/常用实例/4.dos下重启.bat
Size

41B
MD5

0d6a5909b14bd18a28c0a9c05faaece0
SHA1

c63b904cca84b868e4e565c201acb7ae686afde6
SHA256

adff434d139154e955720594c557927f6f3aa5b8e7698259af5eabf0faf5941c
SHA512

5c6082b4a6e795f2759f975767d2910f7a095a4c7e28f97867cb5d7f8adc87530f3fc1668a8f5c0e76a994929c18b849a7e36ee58155286aefd90763321b8998

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2520	2988	cmd.exe	31
PID 2988 wrote to memory of 2520	2988	cmd.exe	31
PID 2988 wrote to memory of 2520	2988	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\VisualBat\常用实例\4.dos下重启.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO G=FFFF:0000 "
  2⤵
  PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads