15f5346f636fa7879882f23611d46da7d7fab3e03cf75366f8721fe54804f8fd | Triage

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 13:49

Sharing

Report Analysis Logs

General

Target

empyrean-main/build.bat
Size

634B
MD5

947b2de91d99e17ff1bd006f0cb2ec58
SHA1

1058ab07fcef83998f420ff322c1cb08fb4ce0c0
SHA256

2158894b4803edf23d2fe3988fce3ffcd190106204596e38b205c013ac317778
SHA512

7a6356453e1547866fa5db754bda156eeefe4f824daeb7e5961292a047abe443cb0e8d21794016173458d029770d2062fad6c9794b9bc040549a5d24e319fc54

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1704	2348	cmd.exe	30
PID 2348 wrote to memory of 1704	2348	cmd.exe	30
PID 2348 wrote to memory of 1704	2348	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\empyrean-main\build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads