52ce2b431c99609f6728ca99402317e318d4f4e792c0457ae38907096421242c | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 13:37

Sharing

Report Analysis Logs

General

Target

搞机工具箱V9.01/Script/test.bat
Size

216B
MD5

0668e1d2f80564784d59e39a58eb328b
SHA1

c8ab760c3bd13db065121b247680d71ad16cac02
SHA256

c693768f2a89e5c16457f063f110202c56ac44f239e48d3215e0b934f49b0904
SHA512

52ddfb1d4c63db63599732e18a50cd679d114a8021ce007b9b4ababb76e4cded9b26c34b05ed04093a7083f0a4f8fb2819384622e7d41937cf2b112b8e1291f9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2148	1916	cmd.exe	32
PID 1916 wrote to memory of 2148	1916	cmd.exe	32
PID 1916 wrote to memory of 2148	1916	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\搞机工具箱V9.01\Script\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads