1b3b1a86a4344b79d495b80a18399bb0d9f877095029bb9ead2fcc7664e9e89c

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 15:57

Target
Adobe Cloud Certificate 292433.wsf
Size 6KB
Sample230214-tdya3aee28
SHA256 fe7c6af8a14af582c3f81749652b9c1ea6c0c002bb181c9ffb154eae609e6458
MD5 ff19670725eaf5df6f3d2ca656d3db27
SHA1 e2795ee5fd02713fd42bbcf2cd0de4c9434475be
SHA512 7a9e6bf7293e77880f93acf462da7f4228df75d374c70cf73531a4ce3305dfcf8db532a64f12528672acca23a9f1fb062d58796b4d1dadade4546d5fecb5188d
SSDEEP 192:H1vlVFYlBjrBE3+bg/XiBaUAEnAsNT084n/qf1oD7:HpxYlBjU+bMJUAL84nC2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	4464	rundll32.exe	68

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	4832	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Adobe Cloud Certificate 292433.wsf"
1⤵
- Blocklisted process makes network request
PID:4832

C:\Windows\system32\rundll32.exe
rundll32 C:\ProgramData\wJPBCKy.HoGKdJI,Wind
1⤵
- Process spawned unexpected child process
PID:4288