02065326c23d7dbb2e4d2ba63e4b428ac397d0814f04ea64515f4cf2e5818487

Analysis

Target
core.bat
Size 222B
Sample210910-xhm8fadfcm
SHA256 6422c2bff92af11fc31c710ca2e8bbe74a41b9e3db9103c64dd6e55baa0899f2
MD5 c1432ae7a15e7d43e44abeaa97bcc77d
SHA1 e348e5f29ed0d16511680f7b57a3b4feaf920026
SHA512 cd73eac203805d233cac32e52aef6261611fa2c662346e3f83b4bc2b57d371ad9f81aee2a31531f3901a9eda03a32fb6a671d9c64b084e966de9cd5cb3ffd3cc
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
424	rundll32.exe
1044	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 424	664	cmd.exe	69
PID 664 wrote to memory of 424	664	cmd.exe	69
PID 664 wrote to memory of 1044	664	cmd.exe	70
PID 664 wrote to memory of 1044	664	cmd.exe	70

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vessel-64.dat,DllMain /i="license.dat"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:424
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vessel-64.dat,update /i="license.dat"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1044