3063c95c7c887f297dab2acc365c2e942ec6c6f5ba3065a3c99177a38923d835 | Triage

Analysis

max time kernel
140s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 07:34

Sharing

Report Analysis Logs

General

Target

datdec.bat
Size

27B
MD5

8d17168790db29eff34a881d45eab0a2
SHA1

ea5c4d1b6303afff04c98160eea414b716354cea
SHA256

812254344ae13467d735dba23c61dc755c96d8cb5a3a9447a62eb41b49e0b200
SHA512

c4f0ebc380a30106edddbc8a8f72bff77df840a80a59587ee89481728720cf058441f9284006bde9562b3471a5cf23042236820d7ce4af049299a2e60bb3d92f

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4224	javaw.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 4224	392	cmd.exe	85
PID 392 wrote to memory of 4224	392	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\datdec.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
  javaw -jar datdec.jar
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4224-2-0x000002226FEF0000-0x0000022270160000-memory.dmp

Filesize
2.4MB

Download
memory/4224-20-0x000002226FED0000-0x000002226FED1000-memory.dmp

Filesize
4KB

Download
memory/4224-30-0x000002226FED0000-0x000002226FED1000-memory.dmp

Filesize
4KB

Download
memory/4224-31-0x000002226FEF0000-0x0000022270160000-memory.dmp

Filesize
2.4MB

Download