87e345cf62178d24cf0a91c136fa06468e5fafb88173f93c8ff3ad7f17b66cb7

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 16:15

Target

obediences/bide.cmd
Size

420B
MD5

57ca313686a484c166c7444a286af29c
SHA1

7f17c854aa8dae032eed8ff83a426761f1e5ccf9
SHA256

59f6563750f9108680e6f850a444c61c5506a27fa44f6df41bfe237508a03084
SHA512

5700a797190e11b97d07aabf3e4a11139e45b2879ed56bd3de793224a32c6808de5982e7e434d4f1a0af5d6aefdf2435ebe5fcc43a6ee749de8af1e483526dad

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1732	hello.com

Loads dropped DLL 1 IoCs

pid	Process
1812	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1732	1812	cmd.exe	29
PID 1812 wrote to memory of 1732	1812	cmd.exe	29
PID 1812 wrote to memory of 1732	1812	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\obediences\bide.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\hello.com
  C:\Users\Admin\AppData\Local\Temp\hello.com obediences\salient.dat,DllRegisterServer
  2⤵
  - Executes dropped EXE
  PID:1732

C:\Users\Admin\AppData\Local\Temp\hello.com

Filesize
44KB

MD5
dd81d91ff3b0763c392422865c9ac12e

SHA1
963b55acc8c566876364716d5aafa353995812a8

SHA256
f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9

SHA512
8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120

Download Submit
\Users\Admin\AppData\Local\Temp\hello.com

Filesize
44KB

MD5
dd81d91ff3b0763c392422865c9ac12e

SHA1
963b55acc8c566876364716d5aafa353995812a8

SHA256
f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9

SHA512
8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120

Download Submit