9235d2676794ff9cc054258ec08e894647ed0112a94f078c9b901d8f1aa049ce

Analysis

max time kernel
10s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 12:02

Target

Files/PasswordGenerator.bat
Size

1KB
MD5

429a368979fe64bc74a57ec0645db610
SHA1

4df46e4adba31ab3b179414cb6b50443e5a4cc3f
SHA256

d6963f1894f13b232f94944f56c4032dbbc8586bd0b6fb6a9d4b6ca401f8379a
SHA512

7b17ead6a1995794a14e913ca963ee3d9193db7396067cd24a6ef9de23e4851f3de881d353ee92bdb5d831bcaca4f636e5774553664d60e5647abc29c8b5c976

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3032	3020	cmd.exe	31
PID 3020 wrote to memory of 3032	3020	cmd.exe	31
PID 3020 wrote to memory of 3032	3020	cmd.exe	31
PID 3032 wrote to memory of 2648	3032	cmd.exe	32
PID 3032 wrote to memory of 2648	3032	cmd.exe	32
PID 3032 wrote to memory of 2648	3032	cmd.exe	32
PID 3020 wrote to memory of 2116	3020	cmd.exe	33
PID 3020 wrote to memory of 2116	3020	cmd.exe	33
PID 3020 wrote to memory of 2116	3020	cmd.exe	33
PID 3020 wrote to memory of 1864	3020	cmd.exe	34
PID 3020 wrote to memory of 1864	3020	cmd.exe	34
PID 3020 wrote to memory of 1864	3020	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Files\PasswordGenerator.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2648
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2116
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:1864