1d6561c4714fadf16bcfb244a5444a959a953424d8e2c6acca6ccb2e20117e74

Analysis

max time kernel
90s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2022 11:16

Target

Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1740 wrote to memory of 5024	1740	cmd.exe	keygen.exe
PID 1740 wrote to memory of 5024	1740	cmd.exe	keygen.exe
PID 1740 wrote to memory of 5024	1740	cmd.exe	keygen.exe
PID 1740 wrote to memory of 1464	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 1464	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 1464	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 4108	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 4108	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 4108	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 4504	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 4504	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 4504	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 4800	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 4800	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 4800	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 3388	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 3388	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 3388	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 1560	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 1560	1740	cmd.exe	builder.exe
PID 1740 wrote to memory of 1560	1740	cmd.exe	builder.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Users\Admin\AppData\Local\Temp\keygen.exe
keygen -path C:\Users\Admin\AppData\Local\Temp\Build -pubkey pub.key -privkey priv.key
2⤵
PID:5024

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3Decryptor.exe
2⤵
PID:1464

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3.exe
2⤵
PID:4108

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_pass.exe
2⤵
PID:4504

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32.dll
2⤵
PID:4800

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32_pass.dll
2⤵
PID:3388

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_ReflectiveDll_DllMain.dll
2⤵
PID:1560

C:\Users\Admin\AppData\Local\Temp\Build\priv.key
Filesize
344B

MD5
c60341671847a470bd295ffdff9222b1

SHA1
feb9a285b8f95a636a50588855f21fdd29a31c96

SHA256
abb21d951095eba69c4a1c1fd2603cdfcafd03741943830c7f3899826c8043e0

SHA512
c34442b4fc5aa7c75ef5bad7316c8ec94a7949fb5b187c425c9c78e795d58f40e925076282b79e9d0019ba00e1c0f5ddd721b2b3d824a8fefc98190cc5600723

Download Submit
C:\Users\Admin\AppData\Local\Temp\Build\pub.key
Filesize
344B

MD5
ada2f85195a0b22df2e6f69bda9ed7be

SHA1
3783cd707a7b8d735e5c79dac663bc5695dca005

SHA256
6998e6d1ab5f6eb71b2bd7c98a0b6a587e172931b03f945883902de185f06584

SHA512
ad3da7aed952486080ac401bde33b48f8a81352b68207d4355ee9fed72a62410e24f24c9c115107c22f3223256e2da4eb33cbda01c0f7ca7c2b04cf85e67bc14

Download Submit
memory/1464-133-0x0000000000000000-mapping.dmp

Download
memory/1560-140-0x0000000000000000-mapping.dmp

Download
memory/3388-139-0x0000000000000000-mapping.dmp

Download
memory/4108-135-0x0000000000000000-mapping.dmp

Download
memory/4504-137-0x0000000000000000-mapping.dmp

Download
memory/4800-138-0x0000000000000000-mapping.dmp

Download
memory/5024-132-0x0000000000000000-mapping.dmp

Download