9fa75ada4b4fdf86eba41ceb8aa1165724fa444ae96c8fc4ac51de57a23cc78b | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 07:18

Sharing

Report Analysis Logs

General

Target

test.bat
Size

725B
MD5

386c2f974f6b43a927ad903691dbe14a
SHA1

5a791a41c1e10685af434661000409a467f59717
SHA256

9fa75ada4b4fdf86eba41ceb8aa1165724fa444ae96c8fc4ac51de57a23cc78b
SHA512

9bfbb75216ccd2c1e098f1bd2e2aaae80d972448f6cfb88b618d6ad9dbbfd90f1f8a4368b14b501f1492d18fe6aff14ddf77d16730f239e3844eb39248abcf58

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2396	2368	cmd.exe	31
PID 2368 wrote to memory of 2396	2368	cmd.exe	31
PID 2368 wrote to memory of 2396	2368	cmd.exe	31
PID 2396 wrote to memory of 1852	2396	cmd.exe	32
PID 2396 wrote to memory of 1852	2396	cmd.exe	32
PID 2396 wrote to memory of 1852	2396	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Control Panel\Desktop" /v Wallpaper
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Control Panel\Desktop" /v Wallpaper
    3⤵
    PID:1852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads