041fc3abf8578ddcead5a8c4a8be8960b7c4d45b21d3370ee2683605e86a728c | Triage™

Analysis

max time kernel
139s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
scrcpy-win64-v2.6.1/open_a_terminal_here.bat
Size 5B
Sample240829-rb2vcsvgjg
SHA256 843758795a84d0d035a7d277ad29cc1ff1702048b4b61ae74b9e3439ae683423
MD5 98359f622a36689d7d76e00c28c5636f
SHA1 2dabc0389dd92cbe254a071958725d8ca7a2467c
SHA512 46bef76e29bc0ea93e15a32f275a7e0607d978da5e1390d2b336e99fa6531e598e4468c43660adb406ab85964e36b859d402314da4af8f17bc5cb8ab7df0676f
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4744	4520	cmd.exe	85
PID 4520 wrote to memory of 4744	4520	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.6.1\open_a_terminal_here.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads