acc11eadcbde58d7ac2be682fc55752b1c6f0467c85d9d1e477c60f31b56fcfb | Triage

Analysis

max time kernel
241s
max time network
241s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 10:03

Sharing

Report Analysis Logs

General

Target

mod_batsty.exe
Size

332KB
MD5

f4d32ca0fe636646b5689b134e3929da
SHA1

6255ce4bfb52ce67cbc5c8fdbf9fc110829f4b36
SHA256

acc11eadcbde58d7ac2be682fc55752b1c6f0467c85d9d1e477c60f31b56fcfb
SHA512

3d407f6f27f9481758e8a57e1e216898b429140b476d51ebab52a057ba8df0e2a41b9034dd087f3ed2baea04a0b0ddfe8f8dc06dbb8ece8e0a56a93d531befb1
SSDEEP

6144:elbkAxgL/r0JTy6x2kGU/fHyB7qMH9O1BNI:e9kAxgL/YTyuDDxMo7I

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 704	2548	mod_batsty.exe	30
PID 2548 wrote to memory of 704	2548	mod_batsty.exe	30
PID 2548 wrote to memory of 704	2548	mod_batsty.exe	30

C:\Users\Admin\AppData\Local\Temp\mod_batsty.exe
"C:\Users\Admin\AppData\Local\Temp\mod_batsty.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2548 -s 32
  2⤵
  PID:704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads