2592ac7a76bc435a210d3646794abf0a654937d0ce6553ebc14982480a169433

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2024, 17:52

Target

Pass 8864/Argon/message.bat
Size

356B
MD5

c76645f1baab3397fc8ea7200d3bb908
SHA1

1a5b47e2ba0cbe028cf20d5d949db616c9b18788
SHA256

17165f9adf2601664b8f6fdbf87749f46fe53c1eccdb9a1e2fad4f46ab8dd967
SHA512

1c422db62279267536fbd615f90bd2648f238599e1a7063834de23e11c7219cf176df0be671cfb7f08a9d7f52a387fb936ae3e2e85446156284fdce422300c7f

Score

1^/10

Delays execution with timeout.exe 7 IoCs

evasion

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3920	4828	cmd.exe	84
PID 4828 wrote to memory of 3920	4828	cmd.exe	84
PID 4828 wrote to memory of 2532	4828	cmd.exe	86
PID 4828 wrote to memory of 2532	4828	cmd.exe	86
PID 4828 wrote to memory of 3276	4828	cmd.exe	87
PID 4828 wrote to memory of 3276	4828	cmd.exe	87
PID 4828 wrote to memory of 5052	4828	cmd.exe	90
PID 4828 wrote to memory of 5052	4828	cmd.exe	90
PID 4828 wrote to memory of 4780	4828	cmd.exe	96
PID 4828 wrote to memory of 4780	4828	cmd.exe	96
PID 4828 wrote to memory of 3460	4828	cmd.exe	97
PID 4828 wrote to memory of 3460	4828	cmd.exe	97
PID 4828 wrote to memory of 3768	4828	cmd.exe	100
PID 4828 wrote to memory of 3768	4828	cmd.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Pass 8864\Argon\message.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3920
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:2532
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:3276
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:5052
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4780
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:3460
- C:\Windows\system32\timeout.exe
  timeout /t 10
  2⤵
  - Delays execution with timeout.exe
  PID:3768