a22bb6c9f1fe7c242449edf809cc4765783662f961c1231d436deb20dc974c5e

Analysis

Target

IP_Spoofer.bat
Size

282B
MD5

4048b6cf9be730c27e34e530e6462c5a
SHA1

f2a0ad5815e9255e6a98aebebf87525b65c984c8
SHA256

4ac41475c9348c242f6e32f35af952a7a38a08acd37d729741b6ecab3f0c05e7
SHA512

313398ce2bef2619d7a26a6bd0996ab20269d314ec3ced893b9d21bd995e307154b788d45bf14771c400ff83fe8525016072c69fdbcff23280970c0ee9b334de

Score

1^/10

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3180 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 3180 taskkill.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4668 wrote to memory of 3180 4668 cmd.exe taskkill.exe
PID 4668 wrote to memory of 3180 4668 cmd.exe taskkill.exe

pid	process
3180	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	3180	taskkill.exe

description	pid	process	target process
PID 4668 wrote to memory of 3180	4668	cmd.exe	taskkill.exe
PID 4668 wrote to memory of 3180	4668	cmd.exe	taskkill.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IP_Spoofer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4668