4a658f49bc680e3f8d07042aecde68a357f65e1c72ed7793f91c8fcd39dec53c

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2023, 12:18

Target
documento.js
Size 30KB
Sample230323-pgln8afe53
SHA256 4a658f49bc680e3f8d07042aecde68a357f65e1c72ed7793f91c8fcd39dec53c
MD5 5db097161a059f2e4763d606b2fa25f6
SHA1 cd3ae5ae40834064c0e36f663f0a302d78fe09fa
SHA512 511528e42799b7491ee952073901b9e99f48adb510d1b7a8b13412cec269d602be62a43f56853fe9792fdb98b8ac4f708d14fc337153ea89ffa704d118f60197
SSDEEP 768:9puzvtUSU5Z+RHlFirGTT07vpbsssz1HD:9iUSUUFirJ7+j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	1288	rundll32.exe	50

Blocklisted process makes network request 4 IoCs

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\documento.js
1⤵
- Blocklisted process makes network request
PID:4540

C:\Windows\system32\rundll32.exe
rundll32 C://ProgramData//qmxedaJgPJrNLsgTVnjDEQFlXp.dll,#16
1⤵
- Process spawned unexpected child process
PID:208

qmxedaJgPJrNLsgTVnjDEQFlXp.dll

Path C:\ProgramData\qmxedaJgPJrNLsgTVnjDEQFlXp.dll
Size 4KB
SHA256 e4d1318baabd1316a645ed86cd0cfb4320a1ba5b60cffe91381ed6f1f6ba9741
MD5 d7349204554f1e8ffe7ad6219e863972
SHA1 561f778cec7aec14b203949ec84243cb47494693
SHA512 70bf05d004600d968eca1a7c12dc111e53cdcede23cff52dbdccb98eb54dc68dc80be7b8d9b68295ee63f3274f7ac98b73be1b383d44ecf0c62e4ace339a51d0
SSDEEP 96:KQIJSaVw/3CSgLVLmxRv+LK7T37Mx7xg7:KQI8cw/hgLV6xB+HZxC
MD5 SHA1 SHA512 SSDEEP

Submit Download