f45bcf726922fe01b71eb17cdaea8fcea57bdeefced3054e118732a41805f15f | Triage

Analysis

max time kernel
98s
max time network
145s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08-11-2024 15:08

Sharing

Report Analysis Logs

General

Target

Export.bat
Size

529B
MD5

bf354baed02884dc4cf002db55818873
SHA1

66475f4de3baf56280ead4fc7c1303f5acbad307
SHA256

283d6ea32f1aa30985dc7ff1564e345ef62ca8193d764418b3031bbba82bb7da
SHA512

205c681c36b856f46c4cb91ae7adab2bd006c4950a660414dffd12ddafd23828d82a2128a19eef4cf05124a2b1237a8f1a3c50643479c91c0cef045df7c98134

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 632	1028	cmd.exe	86
PID 1028 wrote to memory of 632	1028	cmd.exe	86
PID 1028 wrote to memory of 3904	1028	cmd.exe	87
PID 1028 wrote to memory of 3904	1028	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Export.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:632
- C:\Users\Admin\AppData\Local\Temp\SCEWIN_64.exe
  SCEWIN_64.exe /O /S nvram.txt
  2⤵
  PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads