4c7a69fb154f7ee59673b530b305a95601ffab15b2c50bb68187a687cca15da6 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 04:23

Sharing

Report Analysis Logs

General

Target

BatToExe.bat
Size

1KB
MD5

58f9dfaa6c2a6f23011b7c4bc7075509
SHA1

5c0bb2e0a72d119215eadaddbdf4f5ac56a1f4b9
SHA256

4c7a69fb154f7ee59673b530b305a95601ffab15b2c50bb68187a687cca15da6
SHA512

f022f8b2eba4d9f831a44880db630f0de74e17326c72bf8550c0483f6ac145699fba693bc074d125784b4f7af4d2f40739b036dac8e7f418a5e3667d9b655f4c

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2804	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2784	2312	cmd.exe	31
PID 2312 wrote to memory of 2784	2312	cmd.exe	31
PID 2312 wrote to memory of 2784	2312	cmd.exe	31
PID 2312 wrote to memory of 2804	2312	cmd.exe	32
PID 2312 wrote to memory of 2804	2312	cmd.exe	32
PID 2312 wrote to memory of 2804	2312	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\BatToExe.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\system32\mode.com
  Mode 75,3
  2⤵
  PID:2784
- C:\Windows\system32\timeout.exe
  Timeout /T 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads