3863fe1d3a3cae271b02417e5f3c4ced2f227c27e55905e198fec820a19eaf62 | Triage

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 12:35

Sharing

Report Analysis Logs

General

Target

main.bat
Size

37KB
MD5

3c8a495ee741b9c8cea966ae960bba48
SHA1

190cabc05240c6fc20d2dcfefe7df306101e97ea
SHA256

3863fe1d3a3cae271b02417e5f3c4ced2f227c27e55905e198fec820a19eaf62
SHA512

5b86790dacff4d3cbc710da2915e546f4ac5cb327529340d6e79932e091ae01ff474ae3f239ea816051d38610399ad95b060dccca761de6e064cbb5bcfca454e
SSDEEP

768:AFsYL7ruEDHs2guEDHsaOmmmnUjQxOn1TO:AFsY/BmmmnUk01C

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1304	2876	cmd.exe	30
PID 2876 wrote to memory of 1304	2876	cmd.exe	30
PID 2876 wrote to memory of 1304	2876	cmd.exe	30
PID 2876 wrote to memory of 1812	2876	cmd.exe	31
PID 2876 wrote to memory of 1812	2876	cmd.exe	31
PID 2876 wrote to memory of 1812	2876	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\main.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:1812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads