e0e130031ddaebb509d8d90a35250a521e074a1d2be5b7d6ff5aad66422a3898

Resubmissions

02/06/2023, 13:35

02/06/2023, 13:33

max time kernel
81s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2023, 13:33

Target

document_A614_Jun_2.js
Size

4KB
MD5

230443f8af047c8b4597903328500b43
SHA1

ce7861a9fca90884c3e34ef99507a59fd636153f
SHA256

c6aab235f1835b6a4ac64c0293f9814c0bac0f5b99e5ae345ad1c1dee5e5c408
SHA512

ca3dec226aedd3fff58daefdc35fa49fd8639cdb9e5f9b8d097799b3a1e5d12230ef85b3d32e249e0066ee0a2345ed6a7019a7bffa8123fd8e0008a9d8d2273d
SSDEEP

96:tt6seA96t3/y/H/CgWn2JUeSVKFmopZ4z2V9:tt6TA96t3/y/H/CB2IVkWz+

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	2484	conhost.exe	21

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	2432	wscript.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 4032	3860	conhost.exe	91
PID 3860 wrote to memory of 4032	3860	conhost.exe	91
PID 4032 wrote to memory of 468	4032	conhost.exe	92
PID 4032 wrote to memory of 468	4032	conhost.exe	92
PID 468 wrote to memory of 2648	468	conhost.exe	93
PID 468 wrote to memory of 2648	468	conhost.exe	93

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\document_A614_Jun_2.js
1⤵
- Blocklisted process makes network request
PID:2432