9fa75ada4b4fdf86eba41ceb8aa1165724fa444ae96c8fc4ac51de57a23cc78b | Triage

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 07:18

Sharing

Report Analysis Logs

General

Target

test.bat
Size

725B
MD5

386c2f974f6b43a927ad903691dbe14a
SHA1

5a791a41c1e10685af434661000409a467f59717
SHA256

9fa75ada4b4fdf86eba41ceb8aa1165724fa444ae96c8fc4ac51de57a23cc78b
SHA512

9bfbb75216ccd2c1e098f1bd2e2aaae80d972448f6cfb88b618d6ad9dbbfd90f1f8a4368b14b501f1492d18fe6aff14ddf77d16730f239e3844eb39248abcf58

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 3296	876	cmd.exe	84
PID 876 wrote to memory of 3296	876	cmd.exe	84
PID 3296 wrote to memory of 4904	3296	cmd.exe	85
PID 3296 wrote to memory of 4904	3296	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Control Panel\Desktop" /v Wallpaper
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Control Panel\Desktop" /v Wallpaper
    3⤵
    PID:4904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads