0d878b1b9f5c1ae8925e55df9e10b4271eb99970af133e251830044d24296ba8

Analysis

Target

0d7dc074be83f1096f39ba95bfc4e1a17c411dbed0e5eeeb48e88a12d79b541c.js
Size

11KB
MD5

2b33321ead1744461759d9c092b3c7d4
SHA1

00f9f9aa1c82a76619489d8930e6edaf1da0a9a4
SHA256

0d7dc074be83f1096f39ba95bfc4e1a17c411dbed0e5eeeb48e88a12d79b541c
SHA512

e5fcf2d8124f168623389d2107cd806abcc8cb8b2c6d7ebce0167f01f086fda53e1c6d68a5dab9fb207e709a7ba9b7f975ca60a793bc8521c037c60aacaa60cd

Score

7^/10

Deletes itself 1 IoCs

Processes:

wscript.exe

pid process

652 wscript.exe

pid	process
652	wscript.exe

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Microsoft\Credentials\MediaPlayer\VideoManager\media.js	js

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description pid process target process

PID 652 wrote to memory of 3944 652 wscript.exe cscript.exe
PID 652 wrote to memory of 3944 652 wscript.exe cscript.exe

description	pid	process	target process
PID 652 wrote to memory of 3944	652	wscript.exe	cscript.exe
PID 652 wrote to memory of 3944	652	wscript.exe	cscript.exe

C:\Windows\System32\cscript.exe
"C:\Windows\System32\cscript.exe" "C:\Users\Admin\AppData\Local\Microsoft\Credentials\MediaPlayer\VideoManager\media.js"
2⤵
PID:3944

C:\Users\Admin\AppData\Local\Microsoft\Credentials\MediaPlayer\VideoManager\media.js
MD5
2b33321ead1744461759d9c092b3c7d4

SHA1
00f9f9aa1c82a76619489d8930e6edaf1da0a9a4

SHA256
0d7dc074be83f1096f39ba95bfc4e1a17c411dbed0e5eeeb48e88a12d79b541c

SHA512
e5fcf2d8124f168623389d2107cd806abcc8cb8b2c6d7ebce0167f01f086fda53e1c6d68a5dab9fb207e709a7ba9b7f975ca60a793bc8521c037c60aacaa60cd

Download Submit
memory/3944-2-0x0000000000000000-mapping.dmp

Download