e6f27d0e9530edd04a6343618eb98ea1cd748625f42aa0a7ea87b73a8bd886f7

Resubmissions

04-10-2024 13:58

04-10-2024 13:13

04-10-2024 13:07

04-10-2024 02:09

03-10-2024 16:57

03-10-2024 14:11

03-10-2024 01:23

02-10-2024 22:37

max time kernel
147s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-10-2024 01:23

Target

empyrean-main/build.bat
Size

634B
MD5

947b2de91d99e17ff1bd006f0cb2ec58
SHA1

1058ab07fcef83998f420ff322c1cb08fb4ce0c0
SHA256

2158894b4803edf23d2fe3988fce3ffcd190106204596e38b205c013ac317778
SHA512

7a6356453e1547866fa5db754bda156eeefe4f824daeb7e5961292a047abe443cb0e8d21794016173458d029770d2062fad6c9794b9bc040549a5d24e319fc54

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 1380	672	cmd.exe	80
PID 672 wrote to memory of 1380	672	cmd.exe	80
PID 672 wrote to memory of 2476	672	cmd.exe	81
PID 672 wrote to memory of 2476	672	cmd.exe	81
PID 672 wrote to memory of 2476	672	cmd.exe	81
PID 672 wrote to memory of 240	672	cmd.exe	82
PID 672 wrote to memory of 240	672	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\empyrean-main\build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:1380
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python --version
  2⤵
  PID:2476
- C:\Windows\system32\findstr.exe
  findstr " 3.11"
  2⤵
  PID:240