52ce2b431c99609f6728ca99402317e318d4f4e792c0457ae38907096421242c | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 17:20 UTC

Sharing

Report Analysis Logs

General

Target

搞机工具箱V9.01/Script/test.bat
Size

216B
MD5

0668e1d2f80564784d59e39a58eb328b
SHA1

c8ab760c3bd13db065121b247680d71ad16cac02
SHA256

c693768f2a89e5c16457f063f110202c56ac44f239e48d3215e0b934f49b0904
SHA512

52ddfb1d4c63db63599732e18a50cd679d114a8021ce007b9b4ababb76e4cded9b26c34b05ed04093a7083f0a4f8fb2819384622e7d41937cf2b112b8e1291f9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2088	2516	cmd.exe	31
PID 2516 wrote to memory of 2088	2516	cmd.exe	31
PID 2516 wrote to memory of 2088	2516	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\搞机工具箱V9.01\Script\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads