15f5346f636fa7879882f23611d46da7d7fab3e03cf75366f8721fe54804f8fd

Analysis

max time kernel
39s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 22:46

Target

empyrean-main/build.bat
Size

634B
MD5

947b2de91d99e17ff1bd006f0cb2ec58
SHA1

1058ab07fcef83998f420ff322c1cb08fb4ce0c0
SHA256

2158894b4803edf23d2fe3988fce3ffcd190106204596e38b205c013ac317778
SHA512

7a6356453e1547866fa5db754bda156eeefe4f824daeb7e5961292a047abe443cb0e8d21794016173458d029770d2062fad6c9794b9bc040549a5d24e319fc54

Score

1^/10

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	taskmgr.exe

Suspicious use of FindShellTrayWindow 39 IoCs

Suspicious use of SendNotifyMessage 39 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 2096	468	cmd.exe	31
PID 468 wrote to memory of 2096	468	cmd.exe	31
PID 468 wrote to memory of 2096	468	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\empyrean-main\build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:2096

memory/2812-0-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2812-1-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2812-2-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download