e0e130031ddaebb509d8d90a35250a521e074a1d2be5b7d6ff5aad66422a3898

Resubmissions

02/06/2023, 13:35

02/06/2023, 13:33

max time kernel
133s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2023, 13:35

Target

document_A614_Jun_2.js
Size

4KB
MD5

230443f8af047c8b4597903328500b43
SHA1

ce7861a9fca90884c3e34ef99507a59fd636153f
SHA256

c6aab235f1835b6a4ac64c0293f9814c0bac0f5b99e5ae345ad1c1dee5e5c408
SHA512

ca3dec226aedd3fff58daefdc35fa49fd8639cdb9e5f9b8d097799b3a1e5d12230ef85b3d32e249e0066ee0a2345ed6a7019a7bffa8123fd8e0008a9d8d2273d
SSDEEP

96:tt6seA96t3/y/H/CgWn2JUeSVKFmopZ4z2V9:tt6TA96t3/y/H/CB2IVkWz+

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2724	conhost.exe	78

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	4964	wscript.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1176	1976	conhost.exe	90
PID 1976 wrote to memory of 1176	1976	conhost.exe	90
PID 1176 wrote to memory of 4368	1176	conhost.exe	91
PID 1176 wrote to memory of 4368	1176	conhost.exe	91
PID 4368 wrote to memory of 3180	4368	conhost.exe	92
PID 4368 wrote to memory of 3180	4368	conhost.exe	92

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\document_A614_Jun_2.js
1⤵
- Blocklisted process makes network request
PID:4964