52ce2b431c99609f6728ca99402317e318d4f4e792c0457ae38907096421242c | Triage

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 13:37

Sharing

Report Analysis Logs

General

Target

搞机工具箱V9.01/Script/test.bat
Size

216B
MD5

0668e1d2f80564784d59e39a58eb328b
SHA1

c8ab760c3bd13db065121b247680d71ad16cac02
SHA256

c693768f2a89e5c16457f063f110202c56ac44f239e48d3215e0b934f49b0904
SHA512

52ddfb1d4c63db63599732e18a50cd679d114a8021ce007b9b4ababb76e4cded9b26c34b05ed04093a7083f0a4f8fb2819384622e7d41937cf2b112b8e1291f9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 920	3672	cmd.exe	83
PID 3672 wrote to memory of 920	3672	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\搞机工具箱V9.01\Script\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads