3243b16fb9e4f6f8b02ad8883edd2ddcaaea7dac53423231cb20f79225a1f9d3 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 06:19

Sharing

Report Analysis Logs

General

Target

Open me (1).bat
Size

1.2MB
MD5

0e0804c91b1fe59872e6c7c531e5a489
SHA1

5927e5c5e19f8d0f1174f91fa55354cd8fa6ed02
SHA256

3243b16fb9e4f6f8b02ad8883edd2ddcaaea7dac53423231cb20f79225a1f9d3
SHA512

1ab9f7306966ae6e6169556ae0d9c49abe3430255261b351dd9ec2e7056294b244e6d93033f4b60d04e277314cfc8ce8fcdfc59f2ef3e2b9b5f424bcd21cadcf
SSDEEP

3:LjW+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+qn:u

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2008	2960	cmd.exe	31
PID 2960 wrote to memory of 2008	2960	cmd.exe	31
PID 2960 wrote to memory of 2008	2960	cmd.exe	31
PID 2008 wrote to memory of 2128	2008	cmd.exe	33
PID 2008 wrote to memory of 2128	2008	cmd.exe	33
PID 2008 wrote to memory of 2128	2008	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Open me (1).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K start
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads