1d6561c4714fadf16bcfb244a5444a959a953424d8e2c6acca6ccb2e20117e74

Analysis

max time kernel
69s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2022 14:12

Target

Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 3168 wrote to memory of 916	3168	cmd.exe	keygen.exe
PID 3168 wrote to memory of 916	3168	cmd.exe	keygen.exe
PID 3168 wrote to memory of 916	3168	cmd.exe	keygen.exe
PID 3168 wrote to memory of 2292	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 2292	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 2292	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4328	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4328	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4328	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4740	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4740	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4740	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4936	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4936	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4936	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4760	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4760	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4760	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4660	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4660	3168	cmd.exe	builder.exe
PID 3168 wrote to memory of 4660	3168	cmd.exe	builder.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3168

C:\Users\Admin\AppData\Local\Temp\keygen.exe
keygen -path C:\Users\Admin\AppData\Local\Temp\Build -pubkey pub.key -privkey priv.key
2⤵
PID:916

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3Decryptor.exe
2⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3.exe
2⤵
PID:4328

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_pass.exe
2⤵
PID:4740

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32.dll
2⤵
PID:4936

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32_pass.dll
2⤵
PID:4760

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_ReflectiveDll_DllMain.dll
2⤵
PID:4660

C:\Users\Admin\AppData\Local\Temp\Build\priv.key
Filesize
344B

MD5
a01fe80bd439daf7b3ce844d6d049c87

SHA1
59b99d611349fc473c32e5320623783d08191364

SHA256
c90f0d8583f70b2814f7e76253342a177a0fe1739265a576d415b2a0fd21df01

SHA512
e515043c50f629904e69fac3ec0f38a4d3d15e00234e1dab302bf351861450fe4ddd9de8119e8ef15f9e35b47a35481208cd0898297fbd0bae330d6b28b26e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Build\pub.key
Filesize
344B

MD5
c33caeb2fed30526198b3e2089b22b45

SHA1
dc4ca0943ed8aaeb37af473e4e68ead73f46aa3f

SHA256
a9e49a832783226897e48ed26b46b08621f8f9a08c2c69b1462ccb07b9334090

SHA512
a2410c66c21dc2d063d0efb9fd4066bc5708682af190372e443e49426b88a3941f57cdc746112e9243fabd4950697f0948fabf550a2460637bccf8129b9734dd

Download Submit
memory/916-132-0x0000000000000000-mapping.dmp

Download
memory/2292-133-0x0000000000000000-mapping.dmp

Download
memory/4328-135-0x0000000000000000-mapping.dmp

Download
memory/4660-140-0x0000000000000000-mapping.dmp

Download
memory/4740-137-0x0000000000000000-mapping.dmp

Download
memory/4760-139-0x0000000000000000-mapping.dmp

Download
memory/4936-138-0x0000000000000000-mapping.dmp

Download