37185d9df180b61b06b0b411723571eed293ca1d2c3e1c28a74a5fd72e5d9e7b

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2022 09:55

Target

Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1948 wrote to memory of 4252	1948	cmd.exe	keygen.exe
PID 1948 wrote to memory of 4252	1948	cmd.exe	keygen.exe
PID 1948 wrote to memory of 4252	1948	cmd.exe	keygen.exe
PID 1948 wrote to memory of 4956	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 4956	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 4956	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 4928	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 4928	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 4928	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 4868	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 4868	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 4868	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 5056	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 5056	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 5056	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 1048	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 1048	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 1048	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 3284	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 3284	1948	cmd.exe	builder.exe
PID 1948 wrote to memory of 3284	1948	cmd.exe	builder.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\keygen.exe
keygen -path C:\Users\Admin\AppData\Local\Temp\Build -pubkey pub.key -privkey priv.key
2⤵
PID:4252

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3Decryptor.exe
2⤵
PID:4956

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3.exe
2⤵
PID:4928

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_pass.exe
2⤵
PID:4868

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32.dll
2⤵
PID:5056

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32_pass.dll
2⤵
PID:1048

C:\Users\Admin\AppData\Local\Temp\builder.exe
builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_ReflectiveDll_DllMain.dll
2⤵
PID:3284

C:\Users\Admin\AppData\Local\Temp\Build\priv.key
Filesize
344B

MD5
3d41ef8aa13d752f03bfd9747db8bded

SHA1
b987cccb178c02dbd4a8247c30cc30cc351a93a5

SHA256
ae770527f8cefdbe9cacdc1367cccee971feeb768783b9f28808b9fc7ca4b7c8

SHA512
7dd6a15609a457ce95b2d1c2d38e2503c6dcba638e0e1f98a32aad6347f203e68422fd1d8daee0416ae5076c738b33538e13f4f7cb235f63adbcdf3a80c12c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Build\pub.key
Filesize
344B

MD5
556a34d4a8255f886f4beccab999d625

SHA1
acf46cc211973915ca699666c0b9a838a18484d2

SHA256
293f6608b961c7ce11d067ff7b9d8886538a4029d97a736c620437aa3a980dfb

SHA512
5a34596b4ce583d609b5b65f80f93b340157cd0d9cdc97264a7c19aa867d3587f4aedab01791bd78cdc893d0ad39afe144b84d3b28bdb3df220b8df56c751e07

Download Submit
memory/1048-139-0x0000000000000000-mapping.dmp

Download
memory/3284-140-0x0000000000000000-mapping.dmp

Download
memory/4252-132-0x0000000000000000-mapping.dmp

Download
memory/4868-137-0x0000000000000000-mapping.dmp

Download
memory/4928-135-0x0000000000000000-mapping.dmp

Download
memory/4956-133-0x0000000000000000-mapping.dmp

Download
memory/5056-138-0x0000000000000000-mapping.dmp

Download