29c2f57b5678d7515d81e6895dce948bd5eb820c8f27d53fe526ac738eb2b4f5

Analysis

max time kernel
86s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 10:39

Target
documento.js
Size 31KB
Sample230321-mpymmsbg8s
SHA256 29c2f57b5678d7515d81e6895dce948bd5eb820c8f27d53fe526ac738eb2b4f5
MD5 204d41750da91d9a9d5b7e07339d5624
SHA1 295369294958cb66303e15d3fc1e300ddad5521b
SHA512 3b2ff60675242f1aec17d9d061690b362fd3783bf380c7bb8f590cda69e317763bdd50d6685085b925f68778bd831c290247582f895f4857bc558f94a894782c
SSDEEP 768:E8uINUNJl1We/iQiFsqsysYsksksksksC:E8Lk/iQiFsqsysYsksksksksC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	724	rundll32.exe	82

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	1532	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\documento.js
1⤵
- Blocklisted process makes network request
PID:1532

C:\Windows\system32\rundll32.exe
rundll32 C://ProgramData//BczMpBsfPKQQbWqVsGslB.dll,DllRegisterServer
1⤵
- Process spawned unexpected child process
PID:3704

BczMpBsfPKQQbWqVsGslB.dll

Path C:\ProgramData\BczMpBsfPKQQbWqVsGslB.dll
Size 4KB
SHA256 e4d1318baabd1316a645ed86cd0cfb4320a1ba5b60cffe91381ed6f1f6ba9741
MD5 d7349204554f1e8ffe7ad6219e863972
SHA1 561f778cec7aec14b203949ec84243cb47494693
SHA512 70bf05d004600d968eca1a7c12dc111e53cdcede23cff52dbdccb98eb54dc68dc80be7b8d9b68295ee63f3274f7ac98b73be1b383d44ecf0c62e4ace339a51d0
SSDEEP 96:KQIJSaVw/3CSgLVLmxRv+LK7T37Mx7xg7:KQI8cw/hgLV6xB+HZxC
MD5 SHA1 SHA512 SSDEEP

Submit Download