bb943a4b69a11e38ae79651edb071f57da2c9989d6b840eae5efcd4e722d774d

Analysis

max time kernel
6s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-03-2023 13:21

Target

Spotify/Block/BlockTheSpot.bat
Size

179B
MD5

c8a02d2ca0e333fc5aaa003ec36d252e
SHA1

3bdeb7a8715fb37063f5298d17ca5ba3529c2fc5
SHA256

72e4df5d74a0941cdfa21467a9cf0002ff1aafe9ab8cba37eb7901ce0d7d091a
SHA512

cad4289d4e363433edf579f1507fc1479474b11b0db34ef300905cf76cbae5531680dd325eea9347c7b325f73c277528b799b46610585b28cb2d5e6ac1e875f3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1052 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1052 powershell.exe

pid	process
1052	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1052	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1332 wrote to memory of 1052	1332	cmd.exe	powershell.exe
PID 1332 wrote to memory of 1052	1332	cmd.exe	powershell.exe
PID 1332 wrote to memory of 1052	1332	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Spotify\Block\BlockTheSpot.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1332

memory/1052-58-0x000000001B210000-0x000000001B4F2000-memory.dmp

Filesize
2.9MB

Download
memory/1052-59-0x00000000023F0000-0x00000000023F8000-memory.dmp

Filesize
32KB

Download
memory/1052-60-0x0000000002410000-0x0000000002490000-memory.dmp

Filesize
512KB

Download
memory/1052-61-0x0000000002410000-0x0000000002490000-memory.dmp

Filesize
512KB

Download
memory/1052-62-0x0000000002410000-0x0000000002490000-memory.dmp

Filesize
512KB

Download
memory/1052-63-0x000000000241B000-0x0000000002452000-memory.dmp

Filesize
220KB

Download