914f1d0294949edb9715e5b42a3ba3ddaf34f783f0cf2f1208cd1cab159b0c7c | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 16:20

Sharing

Report Analysis Logs

General

Target

䨪  + /service_goodbye_discord.bat
Size

1KB
MD5

c31ea8859699a090ad10e35d6b0383ea
SHA1

09488d53c5632b80ef3710d047fd3a19cb5653b8
SHA256

32b29f16ef73204176601e2967a682e7dae4a27d81145fba955cada387574244
SHA512

237d0f3f3e877ddfd9a5943117c3aaa7e18fb73716efcb6c4050dce158b9ceec65449e46188afffea6032971de7e1e4d56eedc3d6c2b5d1221880007319115b3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1720	2136	cmd.exe	29
PID 2136 wrote to memory of 1720	2136	cmd.exe	29
PID 2136 wrote to memory of 1720	2136	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\䨪  + \service_goodbye_discord.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads