afe034494d14ebcba13643aed15ce6353d7ca7c1f5c8c9b77bf8a787aedee568 | Triage

Resubmissions

09/08/2024, 15:26

240809-st945awdlc 8

09/08/2024, 15:21

240809-srs3tswdjg 7

Analysis

max time kernel
14s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Serveur priver.bat
Size

4KB
MD5

23d18a19c078859659e5c579b849b6db
SHA1

f82f23267d4ec2a778dad4603c0c7724b83c994f
SHA256

afe034494d14ebcba13643aed15ce6353d7ca7c1f5c8c9b77bf8a787aedee568
SHA512

08753d3ebb193867c568080d0c661e5b3f3d32026e0e9db920ebd6ca580ff202b141041a0beb63575628cb6869598a7bf6f70b9915d1ecf3bb3c32966c6dedd7
SSDEEP

24:YDp9tE1xKbo6Ux6ACXEYxbELO7xyoMbqQW8wTQzyRQqWCY3:YDp9teMbomAiXxbELQxxMRWv3WC6

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

pid	Process
4656	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 4656	2008	cmd.exe	85
PID 2008 wrote to memory of 4656	2008	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Serveur priver.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\timeout.exe
  timeout 10
  2⤵
  - Delays execution with timeout.exe
  PID:4656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads