d0a36c4f6e3d1f5ab946a212d01bf334b5770b37d0ccc73855255bde5cc01ca0 | Triage

Analysis

max time kernel
1s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12/09/2024, 07:58

Sharing

Report Analysis Logs

General

Target

cyber.kill.bat
Size

2KB
MD5

d197622cd4bfbb2fa9284c7f29d32dd3
SHA1

6cee93834764c1630febeb43b105e6a4a6b43e63
SHA256

d0a36c4f6e3d1f5ab946a212d01bf334b5770b37d0ccc73855255bde5cc01ca0
SHA512

5c47a1b6fef6fccdd2929f11ca4e73e8441b00f594a11a8319cef3147150db188feb531bf3aa192a8fed30c51aef40baf02800ee0f9855b535a55e566c7589d8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2036	2340	cmd.exe	81
PID 2340 wrote to memory of 2036	2340	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cyber.kill.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads