4a3a3261e6e158841e86f53096ab6891d08d281eae95fda72253c58e17da7cc7 | Triage

Resubmissions

13/09/2024, 23:27

240913-3fxa8avdpq 1

13/09/2024, 23:27

240913-3fjecsvhrc 1

13/09/2024, 23:26

240913-3ex65avhpa 1

13/09/2024, 23:25

240913-3efbbavdkk 1

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 23:25

Sharing

Report Analysis Logs

General

Target

Computer.bat
Size

53B
MD5

5b87058672880a82251cbeb9ecfd2872
SHA1

82288343fc2c2f6a417044229736b3e20b0d6a1d
SHA256

4a3a3261e6e158841e86f53096ab6891d08d281eae95fda72253c58e17da7cc7
SHA512

cfbc78e775f442095705a46d7c8f3a606eb418e82d50ed86059f9b0c97fe6d4686413c6b4e0054351641f8cfcbbe5bd5235d6a9d00c4b9a792ceda0dd573117d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2756	2876	cmd.exe	31
PID 2876 wrote to memory of 2756	2876	cmd.exe	31
PID 2876 wrote to memory of 2756	2876	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Computer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\mountvol.exe
  mountvol.exe c: /D
  2⤵
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads