453eebd2dcf98e15e9ccab2c706438a9d34497631db1f64b6fe9cc3ed41696da

Analysis

max time kernel
30s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2022 18:05

Target

Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 3456 wrote to memory of 4580	3456	cmd.exe	keygen.exe
PID 3456 wrote to memory of 4580	3456	cmd.exe	keygen.exe
PID 3456 wrote to memory of 4580	3456	cmd.exe	keygen.exe
PID 3456 wrote to memory of 4684	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 4684	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 4684	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 1652	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 1652	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 1652	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 4964	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 4964	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 4964	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 2972	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 2972	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 2972	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 2368	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 2368	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 2368	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 4884	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 4884	3456	cmd.exe	builder.exe
PID 3456 wrote to memory of 4884	3456	cmd.exe	builder.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3456

C:\Users\Admin\AppData\Local\Temp\keygen.exe
keygen -path C:\Users\Admin\AppData\Local\Temp\Build -pubkey pub.key -privkey priv.key
2⤵
PID:4580

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3Decryptor.exe
2⤵
PID:4684

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3.exe
2⤵
PID:1652

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_pass.exe
2⤵
PID:4964

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32.dll
2⤵
PID:2972

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32_pass.dll
2⤵
PID:2368

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_ReflectiveDll_DllMain.dll
2⤵
PID:4884

C:\Users\Admin\AppData\Local\Temp\Build\priv.key
Filesize
344B

MD5
95e39f912d9a289bac37f776619aaa3f

SHA1
27cab33176de5d3cc7e3217c5e8e6846a22fa637

SHA256
b2729a3596e28f80c734956b4f39c7729752d63e325d09468301718354ae18f5

SHA512
2feaf14a9826ea1da743608c9589b54e4756f7b7d1ec533a92d07938583dfbc3d89eefa6b6d0388f4578b6bee51924d23beeda9f91804652e646da16b0a8b27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Build\pub.key
Filesize
344B

MD5
c1eef781c6921dcb7f6b7fc86f37029f

SHA1
3aae83d49cf85db840a4f77956e43c53bb4623cd

SHA256
451c3bf60170ac1ba09e6e89f2bdf3e47874b4aa517c52bce6249a6cc2476a4f

SHA512
271bcbd08b1b39b38d169c578abd9b276a18301e9db588e9a746b96f1e7c4d3ae2dc7860d9edb309009abbe111f225cefbec71f19fc88e871953068927ffe688

Download Submit
memory/1652-135-0x0000000000000000-mapping.dmp

Download
memory/2368-139-0x0000000000000000-mapping.dmp

Download
memory/2972-138-0x0000000000000000-mapping.dmp

Download
memory/4580-132-0x0000000000000000-mapping.dmp

Download
memory/4684-133-0x0000000000000000-mapping.dmp

Download
memory/4884-140-0x0000000000000000-mapping.dmp

Download
memory/4964-137-0x0000000000000000-mapping.dmp

Download