560789478bd4c6362c505d33567471854d06f3927b000c8b4e7200953204bc51

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26/05/2023, 01:31

Target

313eb41a17370ec3e6dd22aea2bc71dc603d749634b67f4b42da42074d16b8cc.wsf
Size

76KB
MD5

a4e0f0e011548fa27cda5fe21d23a2a5
SHA1

fc8f5b5a3e0834b65755e748f6d2d6d5445a06f2
SHA256

313eb41a17370ec3e6dd22aea2bc71dc603d749634b67f4b42da42074d16b8cc
SHA512

d003019c7ad4d26ad22568fa598dba8d80a8ba835f6c576ab8b22e1eb527681db48e68cfcda46f20c20830eaac8aff8ca35c2c19d662e9c810cb283a25bc1f4d
SSDEEP

1536:2NbMdMGWPVBKslNl3Dbb49l1k0m7igFTALhrKMEnsZFuG+G:iGGlNBbb+lcigFsLhOMWjG9

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	1220	conhost.exe	30

Blocklisted process makes network request 8 IoCs

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\313eb41a17370ec3e6dd22aea2bc71dc603d749634b67f4b42da42074d16b8cc.wsf"
1⤵
- Blocklisted process makes network request
PID:1368

C:\Windows\system32\conhost.exe
conhost.exe rundll32.exe C:\Users\Public\aZ6CtGzrSYjV2mxFl.dat,bind
1⤵
- Process spawned unexpected child process
PID:792