914f1d0294949edb9715e5b42a3ba3ddaf34f783f0cf2f1208cd1cab159b0c7c | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 16:20

Sharing

Report Analysis Logs

General

Target

䨪  + /service_remove.bat
Size

478B
MD5

3c028ba03ea8ee2b2c5ca1601cfa4dcb
SHA1

683dec12b5c155571ef308489dbc51cad7ff3cd7
SHA256

ad0df08abed59387015af6f3a44190b8f348ba33e32d1b11c6eb4b5ec1f6f89f
SHA512

3aeba7242c9e1cdd37d9d9bfa9edc23bb4796bd9f81f34fc687b0497e8ece8b3e03d8e0927a186087e988595cbf94000a7db53ac7190a334db970afa4131da18

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3996	2356	cmd.exe	84
PID 2356 wrote to memory of 3996	2356	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\䨪  + \service_remove.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads