022e498fe973889e1c2ad0964f0a097a87feb14ceb314a5c19c7ff5d9c7ebb36 | Triage

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 11:33

Sharing

Report Analysis Logs

General

Target

AMI/spoof.bat
Size

57B
MD5

70c372a580ee13ad16ff67d3cc0ff0c6
SHA1

7e92af45a827b70404573f9f8339b2c9297793ec
SHA256

74975bffd064e9e27f44db7738b5f4c971ca1401b5e5d89f4aa50835801abb5c
SHA512

8dd0f5cbf1e66061f11d9129b6da90046ffc36742b2884e271399f17f096dbaf5c1db80d2b4c3e4594961021c96e04c623c684c5c6511cfe6e64b5527d1e50ed

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4800	4556	cmd.exe	83
PID 4556 wrote to memory of 4800	4556	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AMI\spoof.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\AMI\AMIDEWINx64.EXE
  AMIDEWINx64.exe /SU AUTO
  2⤵
  PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads