8fce64111907ee6f0cfa6a5117fd5117574bee3e3bd69cd9efa1c4217f17bc92 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-11-2024 02:28

Sharing

Report Analysis Logs

General

Target

搞机工具箱9.93/Connector.cmd
Size

785B
MD5

29a0631489ffb79560d4cad4630a7482
SHA1

9488765a82d7f472056fa1fa550f06fdffe2573d
SHA256

65fc1a9643226691b82b8739d1b1a3f328108cec336f16bbb03f0e645c863ccd
SHA512

99e7dcb3fb944eab9d9a1eca2e97e68b039e77fd087889589f48d2c4cdafc1911e666cad703222414ccde5f8690999f898422af6b70bfbabe3ac5346dbe45d80

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2544	2100	cmd.exe	31
PID 2100 wrote to memory of 2544	2100	cmd.exe	31
PID 2100 wrote to memory of 2544	2100	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\搞机工具箱9.93\Connector.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads