914f1d0294949edb9715e5b42a3ba3ddaf34f783f0cf2f1208cd1cab159b0c7c | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 16:20

Sharing

Report Analysis Logs

General

Target

䨪  + /service_remove.bat
Size

478B
MD5

3c028ba03ea8ee2b2c5ca1601cfa4dcb
SHA1

683dec12b5c155571ef308489dbc51cad7ff3cd7
SHA256

ad0df08abed59387015af6f3a44190b8f348ba33e32d1b11c6eb4b5ec1f6f89f
SHA512

3aeba7242c9e1cdd37d9d9bfa9edc23bb4796bd9f81f34fc687b0497e8ece8b3e03d8e0927a186087e988595cbf94000a7db53ac7190a334db970afa4131da18

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1804	2284	cmd.exe	31
PID 2284 wrote to memory of 1804	2284	cmd.exe	31
PID 2284 wrote to memory of 1804	2284	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\䨪  + \service_remove.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads