d75619cd0fe939bec360b0d148916522bbd7c5a71454a52b48e51699f0e0add7 | Triage

Analysis

max time kernel
422s
max time network
1147s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
03-12-2024 19:20

Sharing

Report Analysis Logs

General

Target

server-booster/start.bat
Size

14B
MD5

92a6f2af2e2bf7d6e64b7821f5400d1c
SHA1

ee3e35bf31da9e6616c1c6a663fd19b4d745a279
SHA256

89b15dd343075c7271ec08f848803709a915526e81831af0a9df53577b5155b5
SHA512

57ebb186b961d2e73bfe554f247b53558cd358bba5716578c355a85caf783087495ca15e981bed2c049e4485bb3d5edf413d90b0e16f68ba95bbdc7f26f5b29f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 816	2460	cmd.exe	79
PID 2460 wrote to memory of 816	2460	cmd.exe	79
PID 2460 wrote to memory of 816	2460	cmd.exe	79

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\server-booster\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python main.py
  2⤵
  PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads