9fa75ada4b4fdf86eba41ceb8aa1165724fa444ae96c8fc4ac51de57a23cc78b | Triage

Analysis

max time kernel
133s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12/10/2024, 07:18

Sharing

Report Analysis Logs

General

Target

test.bat
Size

725B
MD5

386c2f974f6b43a927ad903691dbe14a
SHA1

5a791a41c1e10685af434661000409a467f59717
SHA256

9fa75ada4b4fdf86eba41ceb8aa1165724fa444ae96c8fc4ac51de57a23cc78b
SHA512

9bfbb75216ccd2c1e098f1bd2e2aaae80d972448f6cfb88b618d6ad9dbbfd90f1f8a4368b14b501f1492d18fe6aff14ddf77d16730f239e3844eb39248abcf58

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 200	3748	cmd.exe	76
PID 3748 wrote to memory of 200	3748	cmd.exe	76
PID 200 wrote to memory of 4664	200	cmd.exe	77
PID 200 wrote to memory of 4664	200	cmd.exe	77

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Control Panel\Desktop" /v Wallpaper
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Control Panel\Desktop" /v Wallpaper
    3⤵
    PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads