9235d2676794ff9cc054258ec08e894647ed0112a94f078c9b901d8f1aa049ce

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 12:02

Target

Files/SMBBruteforcer.bat
Size

747B
MD5

5ee669dcde3786a20dcb3c85075bc200
SHA1

110554c9bbd8a996e2cda1815cc53f66f2548372
SHA256

079e7f161d7717bf40f5904ad64806e3ee8708e0e90b03d3acec7299eceb27da
SHA512

71c78206d2261defeb89a8345fe0b82a415f3e0bfc7b9c27da420bad0964e7a97e1575b58ffcfaa188eea1b90dbe53ef7a1b5a21cae326a2825f06d38ded37d0

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2208	1780	cmd.exe	32
PID 1780 wrote to memory of 2208	1780	cmd.exe	32
PID 1780 wrote to memory of 2208	1780	cmd.exe	32
PID 1780 wrote to memory of 2408	1780	cmd.exe	33
PID 1780 wrote to memory of 2408	1780	cmd.exe	33
PID 1780 wrote to memory of 2408	1780	cmd.exe	33
PID 2408 wrote to memory of 2500	2408	cmd.exe	34
PID 2408 wrote to memory of 2500	2408	cmd.exe	34
PID 2408 wrote to memory of 2500	2408	cmd.exe	34
PID 1780 wrote to memory of 1096	1780	cmd.exe	35
PID 1780 wrote to memory of 1096	1780	cmd.exe	35
PID 1780 wrote to memory of 1096	1780	cmd.exe	35
PID 1780 wrote to memory of 1744	1780	cmd.exe	36
PID 1780 wrote to memory of 1744	1780	cmd.exe	36
PID 1780 wrote to memory of 1744	1780	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Files\SMBBruteforcer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2500
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1096
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:1744