6432da493a05c5fe79964ccb95b079569ceb3165eeb83bd9e84a5c332fb19f72

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 22:26

Target

main.bat
Size

96KB
MD5

40e807605a1543a9cc58a145c2676371
SHA1

dd441a5fe7fc6883a6994309367a2fff2ce60b52
SHA256

6432da493a05c5fe79964ccb95b079569ceb3165eeb83bd9e84a5c332fb19f72
SHA512

5b812042e12f3259d60946dfb762a417213faa4f722dd6a7ec25055d2e2f929f6b07873ca537ec6c6103f968f31c3de9c0c68e793f47009903c9aebb3bf53e7f
SSDEEP

768:FposY9qsaIZz+QK7ruEDHs2guEDHsaXmh82mnUjQxOn1TbzQeQg+miCmY1p02AzT:FCsYOSm9mnUk01seQg+miCm2AMjMJee

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2708	2412	cmd.exe	31
PID 2412 wrote to memory of 2708	2412	cmd.exe	31
PID 2412 wrote to memory of 2708	2412	cmd.exe	31
PID 2412 wrote to memory of 2736	2412	cmd.exe	32
PID 2412 wrote to memory of 2736	2412	cmd.exe	32
PID 2412 wrote to memory of 2736	2412	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\main.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:2736