453eebd2dcf98e15e9ccab2c706438a9d34497631db1f64b6fe9cc3ed41696da

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2022 11:16

Target

Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2260 wrote to memory of 5088	2260	cmd.exe	keygen.exe
PID 2260 wrote to memory of 5088	2260	cmd.exe	keygen.exe
PID 2260 wrote to memory of 5088	2260	cmd.exe	keygen.exe
PID 2260 wrote to memory of 632	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 632	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 632	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 2772	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 2772	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 2772	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 1384	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 1384	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 1384	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 2540	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 2540	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 2540	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 3784	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 3784	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 3784	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 1580	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 1580	2260	cmd.exe	builder.exe
PID 2260 wrote to memory of 1580	2260	cmd.exe	builder.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Users\Admin\AppData\Local\Temp\keygen.exe
keygen -path C:\Users\Admin\AppData\Local\Temp\Build -pubkey pub.key -privkey priv.key
2⤵
PID:5088

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3Decryptor.exe
2⤵
PID:632

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3.exe
2⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_pass.exe
2⤵
PID:1384

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32.dll
2⤵
PID:2540

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32_pass.dll
2⤵
PID:3784

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_ReflectiveDll_DllMain.dll
2⤵
PID:1580

C:\Users\Admin\AppData\Local\Temp\Build\priv.key
Filesize
344B

MD5
d277ba5ee35365b05fa8bb0cedae050c

SHA1
00ae921d98c8f8317930b7fada9a98c68bc7b751

SHA256
f2add1b8ab6d4f6e69a4412d9e5782fb1d20731d39b74637e15e026be3caa610

SHA512
f43a9db8a8bd4364d40acd3bd8ae118040a0ea1b3979c04a4c02be87b991574f41c5996fff3b72bc736d7f93fb277e6b7f0f473f52a23719a7a0cffb10d34bae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Build\pub.key
Filesize
344B

MD5
ce70bed8acffd9dcac7b5f25d29122de

SHA1
3755216a289c30acbf58c667d64fbe8bd4fbe0e5

SHA256
bf0d61de11b5e2b69a606e74329d96bb573c29e6af54831be85efa60ca0c37fd

SHA512
310a1f1fbd4a2049d246d1d408bc4dbee74b7be8318b4abf8dcf7f75c3c5bd798db3002225ec6fd753cb36724d4a73c13410138736cc1955fe1833621e9d3915

Download Submit
memory/632-133-0x0000000000000000-mapping.dmp

Download
memory/1384-137-0x0000000000000000-mapping.dmp

Download
memory/1580-140-0x0000000000000000-mapping.dmp

Download
memory/2540-138-0x0000000000000000-mapping.dmp

Download
memory/2772-135-0x0000000000000000-mapping.dmp

Download
memory/3784-139-0x0000000000000000-mapping.dmp

Download
memory/5088-132-0x0000000000000000-mapping.dmp

Download