e54a0d1fb979d19bf7cbf681df38b284bb5b1b9a5848e220bda941e0417bc7fc

Analysis

max time kernel
85s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 16:14

Target

KFQH Blank Booking Form.bat.exe
Size

1.1MB
MD5

0efb9fa85f31cf712388fcc55484bb96
SHA1

e7f209e7b91a6429c0d2ee24a869751d201f4e65
SHA256

e54a0d1fb979d19bf7cbf681df38b284bb5b1b9a5848e220bda941e0417bc7fc
SHA512

d34890aa9267c0d57bc46e33107e8626f6bb08e48966b7b742e402e597716025691dfc15c5cbdece980b29c974b89440cb9af13792214fc744cb7585550cb96a
SSDEEP

24576:UZfxjLZisWPsuLkB/YAuseX7KvO1YAuJMi+sPV3GykDfMNVzCOgKIQtKoColK5da:0xjIPsMpAuserKvpAuJMi+sPV3GykDf0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

KFQH Blank Booking Form.bat.exe

description	pid	process	target process
PID 1952 wrote to memory of 432	1952	KFQH Blank Booking Form.bat.exe	AppLaunch.exe
PID 1952 wrote to memory of 432	1952	KFQH Blank Booking Form.bat.exe	AppLaunch.exe
PID 1952 wrote to memory of 432	1952	KFQH Blank Booking Form.bat.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\KFQH Blank Booking Form.bat.exe
"C:\Users\Admin\AppData\Local\Temp\KFQH Blank Booking Form.bat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:432

memory/1952-1-0x00000000004D0000-0x00000000005E4000-memory.dmp

Filesize
1.1MB

Download
memory/1952-0-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/1952-2-0x0000000004F50000-0x0000000004FA4000-memory.dmp

Filesize
336KB

Download
memory/1952-3-0x0000000005570000-0x0000000005B14000-memory.dmp

Filesize
5.6MB

Download
memory/1952-4-0x00000000050B0000-0x0000000005142000-memory.dmp

Filesize
584KB

Download
memory/1952-5-0x00000000051F0000-0x000000000528C000-memory.dmp

Filesize
624KB

Download
memory/1952-6-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/1952-7-0x0000000005070000-0x000000000507A000-memory.dmp

Filesize
40KB

Download
memory/1952-9-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download