15f5346f636fa7879882f23611d46da7d7fab3e03cf75366f8721fe54804f8fd

Resubmissions

08-11-2024 22:42

max time kernel
45s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-11-2024 22:42

Target

empyrean-main/build.bat
Size

634B
MD5

947b2de91d99e17ff1bd006f0cb2ec58
SHA1

1058ab07fcef83998f420ff322c1cb08fb4ce0c0
SHA256

2158894b4803edf23d2fe3988fce3ffcd190106204596e38b205c013ac317778
SHA512

7a6356453e1547866fa5db754bda156eeefe4f824daeb7e5961292a047abe443cb0e8d21794016173458d029770d2062fad6c9794b9bc040549a5d24e319fc54

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3032	4700	cmd.exe	81
PID 4700 wrote to memory of 3032	4700	cmd.exe	81
PID 4700 wrote to memory of 2740	4700	cmd.exe	82
PID 4700 wrote to memory of 2740	4700	cmd.exe	82
PID 4700 wrote to memory of 2740	4700	cmd.exe	82
PID 4700 wrote to memory of 3968	4700	cmd.exe	83
PID 4700 wrote to memory of 3968	4700	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\empyrean-main\build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:3032
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python --version
  2⤵
  PID:2740
- C:\Windows\system32\findstr.exe
  findstr " 3.11"
  2⤵
  PID:3968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1656