Windows Write Located at: C:\Windows\write.exe; C:\Windows\System32\write.exe; C:\Windows\SysWOW64\write.exe.
writewriteSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Executes a binary provided in default value of `HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe`. (Execute binary through legitimate proxy. This might be utilized to confuse detection solutions that rely on parent-child relationships.)
write.exe| Type | Rule / Indicator |
|---|---|
| ioc | Changes to HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe |
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml |
write is a Windows LOLBin. Windows Write Located at: C:\Windows\write.exe; C:\Windows\System32\write.exe; C:\Windows\SysWOW64\write.exe.