a0457d69830ac38f45f672e712b46a3ee2d57c504e251eca446c3f7b68cb8b8e | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 21:54

Sharing

Report Analysis Logs

General

Target

VisualBat/常用实例/4.dos下重启.bat
Size

41B
MD5

0d6a5909b14bd18a28c0a9c05faaece0
SHA1

c63b904cca84b868e4e565c201acb7ae686afde6
SHA256

adff434d139154e955720594c557927f6f3aa5b8e7698259af5eabf0faf5941c
SHA512

5c6082b4a6e795f2759f975767d2910f7a095a4c7e28f97867cb5d7f8adc87530f3fc1668a8f5c0e76a994929c18b849a7e36ee58155286aefd90763321b8998

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2724	1100	cmd.exe	85
PID 1100 wrote to memory of 2724	1100	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VisualBat\常用实例\4.dos下重启.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO G=FFFF:0000 "
  2⤵
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads