e6f27d0e9530edd04a6343618eb98ea1cd748625f42aa0a7ea87b73a8bd886f7

Resubmissions

04/10/2024, 13:58

04/10/2024, 13:13

04/10/2024, 13:07

04/10/2024, 02:09

03/10/2024, 16:57

03/10/2024, 14:11

03/10/2024, 01:23

02/10/2024, 22:37

max time kernel
31s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04/10/2024, 13:58

Target

empyrean-main/build.bat
Size

634B
MD5

947b2de91d99e17ff1bd006f0cb2ec58
SHA1

1058ab07fcef83998f420ff322c1cb08fb4ce0c0
SHA256

2158894b4803edf23d2fe3988fce3ffcd190106204596e38b205c013ac317778
SHA512

7a6356453e1547866fa5db754bda156eeefe4f824daeb7e5961292a047abe443cb0e8d21794016173458d029770d2062fad6c9794b9bc040549a5d24e319fc54

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4464	1496	cmd.exe	79
PID 1496 wrote to memory of 4464	1496	cmd.exe	79
PID 1496 wrote to memory of 2224	1496	cmd.exe	80
PID 1496 wrote to memory of 2224	1496	cmd.exe	80
PID 1496 wrote to memory of 2224	1496	cmd.exe	80
PID 1496 wrote to memory of 2792	1496	cmd.exe	81
PID 1496 wrote to memory of 2792	1496	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\empyrean-main\build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:4464
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python --version
  2⤵
  PID:2224
- C:\Windows\system32\findstr.exe
  findstr " 3.11"
  2⤵
  PID:2792