8fce64111907ee6f0cfa6a5117fd5117574bee3e3bd69cd9efa1c4217f17bc92 | Triage

Analysis

max time kernel
93s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 02:28

Sharing

Report Analysis Logs

General

Target

搞机工具箱9.93/Connector.cmd
Size

785B
MD5

29a0631489ffb79560d4cad4630a7482
SHA1

9488765a82d7f472056fa1fa550f06fdffe2573d
SHA256

65fc1a9643226691b82b8739d1b1a3f328108cec336f16bbb03f0e645c863ccd
SHA512

99e7dcb3fb944eab9d9a1eca2e97e68b039e77fd087889589f48d2c4cdafc1911e666cad703222414ccde5f8690999f898422af6b70bfbabe3ac5346dbe45d80

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 2288	3652	cmd.exe	85
PID 3652 wrote to memory of 2288	3652	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\搞机工具箱9.93\Connector.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads