6913d2a0ea1e818abf9214e5b2127faa51fa7874857a50c5238de464a0e2bf17

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2023 15:09

Target

document_D031_Jun_1.js
Size

4KB
MD5

efd208fb9a84c84acdef2522efb1891a
SHA1

8da8243836efb550151fcd4802bd4cd932ef8afc
SHA256

7eb793c1efab64ad1d6941a96f32bb241f5980f8f4f57f8049c82dbcb609078e
SHA512

af983ef936d16f0066d804b2e751bb50750c52bf3799dbd61072480f71f1fb3d40c4aceab380f5dfcc4db3d04f26e4677040082b19814585651434553a66a4ee
SSDEEP

48:1EenqUi+lDuBxHbI+mfIpGC2mfDioNnC2mfDizaqNgj5b3V+KcdPkdFKVX4Hifoj:Wai+hEbppBuBj/chGFmYA3YRo+

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	1768	conhost.exe	32

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	3832	wscript.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1012	4968	conhost.exe	92
PID 4968 wrote to memory of 1012	4968	conhost.exe	92
PID 1012 wrote to memory of 3668	1012	conhost.exe	93
PID 1012 wrote to memory of 3668	1012	conhost.exe	93
PID 3668 wrote to memory of 4264	3668	conhost.exe	94
PID 3668 wrote to memory of 4264	3668	conhost.exe	94

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\document_D031_Jun_1.js
1⤵
- Blocklisted process makes network request
PID:3832