f45bcf726922fe01b71eb17cdaea8fcea57bdeefced3054e118732a41805f15f | Triage

Analysis

max time kernel
147s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-11-2024 14:57

Sharing

Report Analysis Logs

General

Target

Export.bat
Size

529B
MD5

bf354baed02884dc4cf002db55818873
SHA1

66475f4de3baf56280ead4fc7c1303f5acbad307
SHA256

283d6ea32f1aa30985dc7ff1564e345ef62ca8193d764418b3031bbba82bb7da
SHA512

205c681c36b856f46c4cb91ae7adab2bd006c4950a660414dffd12ddafd23828d82a2128a19eef4cf05124a2b1237a8f1a3c50643479c91c0cef045df7c98134

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2484	2176	cmd.exe	78
PID 2176 wrote to memory of 2484	2176	cmd.exe	78
PID 2176 wrote to memory of 4456	2176	cmd.exe	79
PID 2176 wrote to memory of 4456	2176	cmd.exe	79

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Export.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\SCEWIN_64.exe
  SCEWIN_64.exe /O /S nvram.txt
  2⤵
  PID:4456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads