4b9e4bbd675a45f1a99d54bff55576ba3c6d79ab76ea30e143d89fc1543e8580

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 06:22

Target

Files/Apps/logo.bat
Size

3KB
MD5

e96569aa0cc42136bd51bc79455c945b
SHA1

cbb7839981a2b7a9576ea20600183e5f0b3fa23f
SHA256

1b0d647d3f677db2b4bbb598ba9a1f78f5f1d4c5eeda104691a65679b18b7488
SHA512

14343e6bd84f963bc68e45aae0a341c796b2d34a34ef274ce26684118221de5c9da2edba456332e6f95eebfb488890cc7a75e5501978fcc631025db63cc59a13

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 2428 wrote to memory of 4032	2428	cmd.exe	cmd.exe
PID 2428 wrote to memory of 4032	2428	cmd.exe	cmd.exe
PID 2428 wrote to memory of 2568	2428	cmd.exe	cmd.exe
PID 2428 wrote to memory of 2568	2428	cmd.exe	cmd.exe
PID 2568 wrote to memory of 3296	2568	cmd.exe	chcp.com
PID 2568 wrote to memory of 3296	2568	cmd.exe	chcp.com
PID 2428 wrote to memory of 1968	2428	cmd.exe	chcp.com
PID 2428 wrote to memory of 1968	2428	cmd.exe	chcp.com
PID 2428 wrote to memory of 1508	2428	cmd.exe	chcp.com
PID 2428 wrote to memory of 1508	2428	cmd.exe	chcp.com

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\logo.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:3296
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1968
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:1508