47961c394d3b03bd1670e702b2ac59071dc54535657c82772e08e0a2d767b7c4 | Triage

Analysis

max time kernel
419s
max time network
1153s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10/08/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mineways/scripting/export_and_annotate.bat
Size

428B
MD5

36d78bdff7da5708076b1d7d23782d15
SHA1

c81596e5c637125eb681cb4d06def08809f28961
SHA256

7d655944a70362b674b83e2b6145efdbe8a0da233b6e6c5c0afce6b3cccddcd1
SHA512

ac0f530d751d6a545429c15e7c4763f010df7dbbaf1b746424c1eb55558395479c1601c141f829e921e5e935c8d77a7ce1ba9bf962c54e4204e428e3e73e6027

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4492	5076	cmd.exe	84
PID 5076 wrote to memory of 4492	5076	cmd.exe	84
PID 5076 wrote to memory of 4492	5076	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mineways\scripting\export_and_annotate.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python annotate_map.py
  2⤵
  PID:4492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads