4585a02b2bef0f4ee03c05eb71a713d2635e1ec0d9876e263fc45d01f1b2dd79

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2023, 12:36

Target
documento.js
Size 28KB
Sample230323-psw94aff39
SHA256 4585a02b2bef0f4ee03c05eb71a713d2635e1ec0d9876e263fc45d01f1b2dd79
MD5 1932d5cf05220872391eb16b5c76a2ec
SHA1 8cf0bc6bcf316afa4090cef6c248849b8f418bf5
SHA512 583e4246aa99de36c075923be7f06569455b70a21cbbbd44cca5632cb8577abc213430a915933ab3768ba3e02c8c20957aa7a206a44b9dce5f110f1d6c0d44b7
SSDEEP 768:b7LFLZE1uSE7SuePrHrwrL2wFDF7FeFYFnFCIKp:fLFLi1bPrHrwrymxJ4uFC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2128	rundll32.exe	34

Blocklisted process makes network request 3 IoCs

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\documento.js
1⤵
- Blocklisted process makes network request
PID:4920

C:\Windows\system32\rundll32.exe
rundll32 C://ProgramData//cwPJpSHBFteEcSMQcFpZLfQOHjPORsHBy.dll,#16
1⤵
- Process spawned unexpected child process
PID:1820

cwPJpSHBFteEcSMQcFpZLfQOHjPORsHBy.dll

Path C:\ProgramData\cwPJpSHBFteEcSMQcFpZLfQOHjPORsHBy.dll
Size 4KB
SHA256 e4d1318baabd1316a645ed86cd0cfb4320a1ba5b60cffe91381ed6f1f6ba9741
MD5 d7349204554f1e8ffe7ad6219e863972
SHA1 561f778cec7aec14b203949ec84243cb47494693
SHA512 70bf05d004600d968eca1a7c12dc111e53cdcede23cff52dbdccb98eb54dc68dc80be7b8d9b68295ee63f3274f7ac98b73be1b383d44ecf0c62e4ace339a51d0
SSDEEP 96:KQIJSaVw/3CSgLVLmxRv+LK7T37Mx7xg7:KQI8cw/hgLV6xB+HZxC
MD5 SHA1 SHA512 SSDEEP

Submit Download