6301a33709f67757e3e4ce1fcf6ac38a99779d37fa886d5caa5fb18f9f173140

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 23:01

Target

Defender.bat
Size

1KB
MD5

7e5b21528e17e4a06b6be3138251dc64
SHA1

fc573ea384ed1ea667f29c396d6820ef95936a66
SHA256

6301a33709f67757e3e4ce1fcf6ac38a99779d37fa886d5caa5fb18f9f173140
SHA512

3dc1e8bfcaee1fcfd31efc69445724c1c716930470fac8e378e9db673ccc3b34576b3e720c110e7f9651c38f1bc0a4500573b197e081c7a4fd97718a67b874fb

Score

1^/10

Delays execution with timeout.exe 6 IoCs

evasion

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2624	2720	cmd.exe	32
PID 2720 wrote to memory of 2624	2720	cmd.exe	32
PID 2720 wrote to memory of 2624	2720	cmd.exe	32
PID 2720 wrote to memory of 2864	2720	cmd.exe	33
PID 2720 wrote to memory of 2864	2720	cmd.exe	33
PID 2720 wrote to memory of 2864	2720	cmd.exe	33
PID 2720 wrote to memory of 2932	2720	cmd.exe	34
PID 2720 wrote to memory of 2932	2720	cmd.exe	34
PID 2720 wrote to memory of 2932	2720	cmd.exe	34
PID 2720 wrote to memory of 2652	2720	cmd.exe	35
PID 2720 wrote to memory of 2652	2720	cmd.exe	35
PID 2720 wrote to memory of 2652	2720	cmd.exe	35
PID 2720 wrote to memory of 2644	2720	cmd.exe	36
PID 2720 wrote to memory of 2644	2720	cmd.exe	36
PID 2720 wrote to memory of 2644	2720	cmd.exe	36
PID 2720 wrote to memory of 2416	2720	cmd.exe	37
PID 2720 wrote to memory of 2416	2720	cmd.exe	37
PID 2720 wrote to memory of 2416	2720	cmd.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Defender.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:2624
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2864
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2932
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2652
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2644
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2416