01b06d0edf88424afce8026c8cf914837212e82ab064f966dd45fa6b55882fdb

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-11-2022 19:45

Target

run.cmd
Size

159B
MD5

bc2545a660518ef0271bdd6a8be3513c
SHA1

ac0e485fe9101774c61a50d81dec32e174795e08
SHA256

f96ca4d15febe51758689d9c93c5ff06449a67aacc9b619c249dd00f7b65d179
SHA512

6b7dc66814b4a74dd8b39c631f24bef16a98a5ac18bb7e31531c41b54c239a56e1050ed3d7f48c9e7a9da094177bd6930148c08eb4ca937a59ca4eb235fc142a

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

autorun.exe

pid process

1720 autorun.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1960 cmd.exe

pid	process
1720	autorun.exe

pid	process
1960	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1960 wrote to memory of 1712	1960	cmd.exe	cmd.exe
PID 1960 wrote to memory of 1712	1960	cmd.exe	cmd.exe
PID 1960 wrote to memory of 1712	1960	cmd.exe	cmd.exe
PID 1960 wrote to memory of 2000	1960	cmd.exe	xcopy.exe
PID 1960 wrote to memory of 2000	1960	cmd.exe	xcopy.exe
PID 1960 wrote to memory of 2000	1960	cmd.exe	xcopy.exe
PID 1960 wrote to memory of 1720	1960	cmd.exe	autorun.exe
PID 1960 wrote to memory of 1720	1960	cmd.exe	autorun.exe
PID 1960 wrote to memory of 1720	1960	cmd.exe	autorun.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f "
2⤵
PID:1712

C:\Windows\system32\xcopy.exe
xcopy /h /y \ver123.dll C:\Users\Admin\AppData\Local\Temp\LotOfLibraries.1
2⤵
PID:2000

C:\Users\Admin\AppData\Local\Temp\autorun.exe
C:\Users\Admin\AppData\Local\Temp\autorun.exe C:\Users\Admin\AppData\Local\Temp\LotOfLibraries.1,#1
2⤵
- Executes dropped EXE
PID:1720

C:\Users\Admin\AppData\Local\Temp\autorun.exe
Filesize
44KB

MD5
dd81d91ff3b0763c392422865c9ac12e

SHA1
963b55acc8c566876364716d5aafa353995812a8

SHA256
f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9

SHA512
8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120

Download Submit
\Users\Admin\AppData\Local\Temp\autorun.exe
Filesize
44KB

MD5
dd81d91ff3b0763c392422865c9ac12e

SHA1
963b55acc8c566876364716d5aafa353995812a8

SHA256
f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9

SHA512
8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120

Download Submit
memory/1712-54-0x0000000000000000-mapping.dmp

Download
memory/1720-57-0x0000000000000000-mapping.dmp

Download
memory/2000-55-0x0000000000000000-mapping.dmp

Download