26a8acb862ae176d149801a6714296c29f7a532719bc05b3031e39868bff36db

Analysis

max time kernel
91s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2022 06:33

Target

run.cmd
Size

159B
MD5

bc2545a660518ef0271bdd6a8be3513c
SHA1

ac0e485fe9101774c61a50d81dec32e174795e08
SHA256

f96ca4d15febe51758689d9c93c5ff06449a67aacc9b619c249dd00f7b65d179
SHA512

6b7dc66814b4a74dd8b39c631f24bef16a98a5ac18bb7e31531c41b54c239a56e1050ed3d7f48c9e7a9da094177bd6930148c08eb4ca937a59ca4eb235fc142a

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

autorun.exe

pid process

2024 autorun.exe

pid	process
2024	autorun.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 4588 wrote to memory of 4956	4588	cmd.exe	cmd.exe
PID 4588 wrote to memory of 4956	4588	cmd.exe	cmd.exe
PID 4588 wrote to memory of 4136	4588	cmd.exe	xcopy.exe
PID 4588 wrote to memory of 4136	4588	cmd.exe	xcopy.exe
PID 4588 wrote to memory of 2024	4588	cmd.exe	autorun.exe
PID 4588 wrote to memory of 2024	4588	cmd.exe	autorun.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f "
2⤵
PID:4956

C:\Windows\system32\xcopy.exe
xcopy /h /y \ver123.dll C:\Users\Admin\AppData\Local\Temp\LotOfLibraries.1
2⤵
PID:4136

C:\Users\Admin\AppData\Local\Temp\autorun.exe
C:\Users\Admin\AppData\Local\Temp\autorun.exe C:\Users\Admin\AppData\Local\Temp\LotOfLibraries.1,#1
2⤵
- Executes dropped EXE
PID:2024

C:\Users\Admin\AppData\Local\Temp\autorun.exe
Filesize
70KB

MD5
ef3179d498793bf4234f708d3be28633

SHA1
dd399ae46303343f9f0da189aee11c67bd868222

SHA256
b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

SHA512
02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

Download Submit
C:\Users\Admin\AppData\Local\Temp\autorun.exe
Filesize
70KB

MD5
ef3179d498793bf4234f708d3be28633

SHA1
dd399ae46303343f9f0da189aee11c67bd868222

SHA256
b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

SHA512
02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

Download Submit
memory/2024-134-0x0000000000000000-mapping.dmp

Download
memory/4136-133-0x0000000000000000-mapping.dmp

Download
memory/4956-132-0x0000000000000000-mapping.dmp

Download