2a7d9947c21e7cec44c75bc01953a2adf5da0273ac48e7e2b1b0c9bbd4af9856 | Triage

Analysis

max time kernel
146s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
30/07/2024, 17:23

Sharing

Report Analysis Logs

General

Target

Shrek-Tools-main/utilities/Start.bat
Size

34B
MD5

c24add9b40129d29c40e5fd94ccd1812
SHA1

6a9c4c822f6aa8a46d5e6a8c5c7c09eca83bca80
SHA256

9df81babbfd6f7054c60943ad0179f0a74ef814080252554f8f4e97fe5a790eb
SHA512

c93373a9a2a4cb4d83c7579f9c3cb82016542e904310f073cd39f5b20ca349efcb3359d8976d6d01c87d613ce8c31cb99ad19c35e96b9721c57b4d0ea1715789

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 660	3532	cmd.exe	83
PID 3532 wrote to memory of 660	3532	cmd.exe	83
PID 3532 wrote to memory of 660	3532	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Shrek-Tools-main\utilities\Start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python Menu.py
  2⤵
  PID:660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads