04ff3c5520e0b1ad1e9e8dffbf834675b969bf034f76650f5dc537e6d0ac1e3b

Analysis

max time kernel
14s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 15:20

Target

script.bat
Size

4KB
MD5

655097ff83706f5e76630227681abb29
SHA1

31e8ba26f6aae53b0f8d9f0590a85a400556ae42
SHA256

04ff3c5520e0b1ad1e9e8dffbf834675b969bf034f76650f5dc537e6d0ac1e3b
SHA512

1b27de60d822f68d0778fadf953b9f7eb07afd6dd1e47a7f58a2506aff071003519773e8fec14e18c05afe737fc8f8861d4eacad608d29aef75f50d70ccf9c08
SSDEEP

96:qlbtznypNx3K/S3R5Lnfkk9oly7vmPjVnKDdet2SMDmsXJ57vHnjne7zYbA+alkd:q1tznypNx3K/S3R5Lfkk9FTmPjVnKDdp

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 3684	4864	cmd.exe	83
PID 4864 wrote to memory of 3684	4864	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\script.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3684