3243b16fb9e4f6f8b02ad8883edd2ddcaaea7dac53423231cb20f79225a1f9d3 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 06:19

Sharing

Report Analysis Logs

General

Target

Open me (1).bat
Size

1.2MB
MD5

0e0804c91b1fe59872e6c7c531e5a489
SHA1

5927e5c5e19f8d0f1174f91fa55354cd8fa6ed02
SHA256

3243b16fb9e4f6f8b02ad8883edd2ddcaaea7dac53423231cb20f79225a1f9d3
SHA512

1ab9f7306966ae6e6169556ae0d9c49abe3430255261b351dd9ec2e7056294b244e6d93033f4b60d04e277314cfc8ce8fcdfc59f2ef3e2b9b5f424bcd21cadcf
SSDEEP

3:LjW+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+q+qn:u

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2212	4740	cmd.exe	85
PID 4740 wrote to memory of 2212	4740	cmd.exe	85
PID 2212 wrote to memory of 4784	2212	cmd.exe	87
PID 2212 wrote to memory of 4784	2212	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Open me (1).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K start
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:4784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads