88a3cc48a8bcef7873b286ecaf3a4e618dd20fd478fd9fae1634bdb5b4b79461 | Triage

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 11:42

Sharing

Report Analysis Logs

General

Target

docs/release/build/newsrc.bat
Size

3KB
MD5

ed8cdc9f62449931d3cfafaa62b4353f
SHA1

622ea3fe5eded6a8e555bf4e0384d3c8ffce5a3f
SHA256

2c1b6d89592f8ec856db1fb20f50f0c54721507c5af81f045f1b40d9e883512e
SHA512

1f6b40d838dd4658cc8328dcecb74f5050a21b59a1b41da791654bb2b6720ba6340ea8962b640bc98497992b0e915d93fd1a8681b105501398a983636752f461

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 3440	4652	cmd.exe	82
PID 4652 wrote to memory of 3440	4652	cmd.exe	82
PID 4652 wrote to memory of 4716	4652	cmd.exe	83
PID 4652 wrote to memory of 4716	4652	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\docs\release\build\newsrc.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\system32\xcopy.exe
  xcopy /E /Y c:\MAMEUI\src\osd\winui c:\MAMEUI\docs\release\src\osd\winui
  2⤵
  PID:3440
- C:\Windows\system32\xcopy.exe
  xcopy /T c:\MAMEUI\scripts c:\MAMEUI\docs\release\scripts
  2⤵
  PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads