44333db1752f497f16fbb2c342f708c99029c80ab7bf6ab52918899b079c61f6

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 23:55

Target

bin/StartTestWrapper-NT.bat
Size

4KB
MD5

805542ca8e81a7a1213392561aade890
SHA1

20e80bff138bf8524c265b37ef75f5d137296d88
SHA256

7347f6f3d9212b552b663a50e3e0e03bebd68250722245d19da0eedf83e36492
SHA512

293421f00a665eff6c7d320d4e0ccdcf53d8406a2808dc1220f9783e1350893afff0f35525e666285db8c31b21e09511493490894feb49dd6c74ae2b1903d1d4
SSDEEP

96:KsMHMNIM6aFpgdWYldACta8Ku+7AqFpfJaDR3QXSmjX:KhHg9LEdoZ8Kl7/fgD4SmjX

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 680	1180	cmd.exe	88
PID 1180 wrote to memory of 680	1180	cmd.exe	88
PID 1180 wrote to memory of 4876	1180	cmd.exe	90
PID 1180 wrote to memory of 4876	1180	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bin\StartTestWrapper-NT.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\bin\wrapper-windows-x86-64.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\wrapper-windows-x86-64.exe" --request_delta_binary_bits "../conf/wrapper.conf"
  2⤵
  PID:680
- C:\Users\Admin\AppData\Local\Temp\bin\wrapper-windows-x86-64.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\wrapper-windows-x86-64.exe" -t "../conf/wrapper.conf"
  2⤵
  PID:4876