4b9e4bbd675a45f1a99d54bff55576ba3c6d79ab76ea30e143d89fc1543e8580 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 06:22

Sharing

Report Analysis Logs

General

Target

Files/Apps/logo.bat
Size

3KB
MD5

e96569aa0cc42136bd51bc79455c945b
SHA1

cbb7839981a2b7a9576ea20600183e5f0b3fa23f
SHA256

1b0d647d3f677db2b4bbb598ba9a1f78f5f1d4c5eeda104691a65679b18b7488
SHA512

14343e6bd84f963bc68e45aae0a341c796b2d34a34ef274ce26684118221de5c9da2edba456332e6f95eebfb488890cc7a75e5501978fcc631025db63cc59a13

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2904 wrote to memory of 2000	2904	cmd.exe	cmd.exe
PID 2904 wrote to memory of 2000	2904	cmd.exe	cmd.exe
PID 2904 wrote to memory of 2000	2904	cmd.exe	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\logo.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads