63b0e303a05ad2eb2a93e2f9cd96e50361cf1e0d29f9cab8b0a98d1185347f8a | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 13:26

Sharing

Report Analysis Logs

General

Target

runvm.bat
Size

49B
MD5

1ab4dc21dcb24f5b7345ce5c0b794b82
SHA1

18f722ad31ee9d81181f8ca2cef60a70b03bb030
SHA256

ac2103023d146e62c3b708384ae0ed044d17258901272068ef93c15c9f5aa06e
SHA512

83f1d566b8f5b7875811762433cf7c2722225c789a3b917b2c4184a442d9d6af9c6fe703ce354d223824cfe8ed86e6e7780ec02008c093298fbcd3c08840dbdd

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2104	vm.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2104	1292	cmd.exe	32
PID 1292 wrote to memory of 2104	1292	cmd.exe	32
PID 1292 wrote to memory of 2104	1292	cmd.exe	32
PID 1292 wrote to memory of 2104	1292	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\runvm.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\vm.exe
  "vm.exe"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads