6da8bd1c06f2f2ef79cedecb574c961265bf11ad87e62b7767e55b4b42f3145d | Triage

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 10:08

Sharing

Report Analysis Logs

General

Target

安装.bat
Size

1KB
MD5

5be68779449563b7e43848fa45301b85
SHA1

d5d0abb284936fbde900dcddc25ebcdb2648eb8c
SHA256

48638a565ffd649536b6b059e1e02574a0996153899a843521bffc79c561dcc9
SHA512

ec646d755d7165aee55b9141ee2e6433d89778e26ea445838011f66dedea8c0cb2c18d27ea497e545ca3b2a26f008e43f542175a9a39d78ff2c7ccd281b46879

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4604	5028	cmd.exe	83
PID 5028 wrote to memory of 4604	5028	cmd.exe	83
PID 5028 wrote to memory of 3864	5028	cmd.exe	84
PID 5028 wrote to memory of 3864	5028	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\安装.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\system32\mode.com
  mode con cols=71 lines=18
  2⤵
  PID:4604
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s ▒│╛░╫┼╔½╣ñ╛▀═Ω├└░µ3.1.dll
  2⤵
  PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads