63b0e303a05ad2eb2a93e2f9cd96e50361cf1e0d29f9cab8b0a98d1185347f8a | Triage™

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
runvm.bat
Size 49B
Sample240727-qpgkxavblb
SHA256 ac2103023d146e62c3b708384ae0ed044d17258901272068ef93c15c9f5aa06e
MD5 1ab4dc21dcb24f5b7345ce5c0b794b82
SHA1 18f722ad31ee9d81181f8ca2cef60a70b03bb030
SHA512 83f1d566b8f5b7875811762433cf7c2722225c789a3b917b2c4184a442d9d6af9c6fe703ce354d223824cfe8ed86e6e7780ec02008c093298fbcd3c08840dbdd
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2104	vm.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2104	1292	cmd.exe	32
PID 1292 wrote to memory of 2104	1292	cmd.exe	32
PID 1292 wrote to memory of 2104	1292	cmd.exe	32
PID 1292 wrote to memory of 2104	1292	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\runvm.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\vm.exe
  "vm.exe"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads