2592ac7a76bc435a210d3646794abf0a654937d0ce6553ebc14982480a169433

Analysis

max time kernel
92s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26/12/2024, 17:52

Target

Pass 8864/Argon/message.bat
Size

356B
MD5

c76645f1baab3397fc8ea7200d3bb908
SHA1

1a5b47e2ba0cbe028cf20d5d949db616c9b18788
SHA256

17165f9adf2601664b8f6fdbf87749f46fe53c1eccdb9a1e2fad4f46ab8dd967
SHA512

1c422db62279267536fbd615f90bd2648f238599e1a7063834de23e11c7219cf176df0be671cfb7f08a9d7f52a387fb936ae3e2e85446156284fdce422300c7f

Score

1^/10

Delays execution with timeout.exe 7 IoCs

evasion

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 1168	3392	cmd.exe	78
PID 3392 wrote to memory of 1168	3392	cmd.exe	78
PID 3392 wrote to memory of 3140	3392	cmd.exe	79
PID 3392 wrote to memory of 3140	3392	cmd.exe	79
PID 3392 wrote to memory of 3692	3392	cmd.exe	80
PID 3392 wrote to memory of 3692	3392	cmd.exe	80
PID 3392 wrote to memory of 2924	3392	cmd.exe	81
PID 3392 wrote to memory of 2924	3392	cmd.exe	81
PID 3392 wrote to memory of 3172	3392	cmd.exe	82
PID 3392 wrote to memory of 3172	3392	cmd.exe	82
PID 3392 wrote to memory of 3420	3392	cmd.exe	83
PID 3392 wrote to memory of 3420	3392	cmd.exe	83
PID 3392 wrote to memory of 1124	3392	cmd.exe	84
PID 3392 wrote to memory of 1124	3392	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Pass 8864\Argon\message.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1168
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:3140
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:3692
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:2924
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3172
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:3420
- C:\Windows\system32\timeout.exe
  timeout /t 10
  2⤵
  - Delays execution with timeout.exe
  PID:1124