1f6c27d67c4779d6cff61338476ede3f73a611fee1cd25dbcf86d7649f6f3f4a | Triage

Resubmissions

29/09/2024, 23:32

240929-3jc2rawcll 6

29/09/2024, 23:30

240929-3hg93swbqm 3

25/09/2024, 18:11

240925-wsrsyasgmc 6

29/07/2024, 03:17

240729-dtj6davdje 3

11/03/2024, 21:36

240311-1gd5xshb65 3

11/03/2024, 21:33

240311-1ehqbsha93 7

14/01/2024, 19:59

240114-yqpa5seaa5 7

14/01/2024, 19:38

240114-ycs26sdhc7 7

Analysis

max time kernel
1561s
max time network
1563s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 23:32

Sharing

Report Analysis Logs

General

Target

ERROR437_02/ds.bat
Size

142B
MD5

fb7d933180ae9c8f3efc27f3082c7947
SHA1

0c917fdf042a92fc34cc01e9946de3c3e433677f
SHA256

42854cba720e50ff061ebcad41ccb6730f8ee4c1ef1a4c349298067da92c8c18
SHA512

888e9f6bce05e176542642d1572be3c1095fe7eba5af4f07fcbdd66561ac062cea2629e6cec70169c47f025864943543ae547ea52c6899ccb146ba16cb8b7848

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2348	2064	cmd.exe	32
PID 2064 wrote to memory of 2348	2064	cmd.exe	32
PID 2064 wrote to memory of 2348	2064	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ERROR437_02\ds.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\system32\java.exe
  java -Xmx1024M -Xms1024M -cp clickme.jar "-Dorg.lwjgl.librarypath=C:\Users\Admin\AppData\Local\Temp\ERROR437_02/natives" "-Dnet.java.games.input.librarypath=C:\Users\Admin\AppData\Local\Temp\ERROR437_02/natives" Start
  2⤵
  PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-2-0x0000000002760000-0x00000000029D0000-memory.dmp

Filesize
2.4MB

Download
memory/2348-10-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2348-12-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2348-13-0x0000000002760000-0x00000000029D0000-memory.dmp

Filesize
2.4MB

Download