36c022bbca9f87049f72b08cc9e4f3edf433d64eb76f3d60abb7841ff3ec8623

Analysis

max time kernel
118s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 06:37

Target

Claim_A107.wsf
Size

63KB
MD5

927d7366d559accd41c668971aa722e7
SHA1

6b19ba118514669280a8c0ba84acb25308d5ac44
SHA256

36c022bbca9f87049f72b08cc9e4f3edf433d64eb76f3d60abb7841ff3ec8623
SHA512

9b0bcc0b45d0974072e7d6ce3626c27639cd91a4a957d2237dc34ae60a3c54ce8b6cd59994c8d127aa16339f435f497d0b15d40e04c1cfa49388b823cb6ef4ca
SSDEEP

768:wsfp6DKbpQyrDXn2kLr4bpSiJcPBmghsbpzOCk9lOnxtEsxIcMyrDfn2kLrcbp6J:7dQ1kO3J+mFpzOCKsE2MjkydU5

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	3284	conhost.exe	60

Blocklisted process makes network request 6 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1724	2232	conhost.exe	92
PID 2232 wrote to memory of 1724	2232	conhost.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Claim_A107.wsf"
1⤵
- Blocklisted process makes network request
PID:1996

C:\Windows\system32\conhost.exe
conhost.exe rundll32.exe C:\Users\Public\aO8uCWXKEyqgHm.dat,bind
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Public\aO8uCWXKEyqgHm.dat,bind
  2⤵
  PID:1724