d5ab54c78f95d027c2ac14879fe9d044b0524a7bcc2a1c59122ee5b67cba379a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 13:51

Target

Gccg/Install Pokemon Cards.bat
Size

109B
MD5

c82caf6a26f795e440526e238ec31583
SHA1

64153376b1f0eb5c4baf1d2d3f145d017811d526
SHA256

8a7c4d4c01f12a5bfb8a59af2a42ac773079252387dca37b0150047d783be0bf
SHA512

4b27204071a212c44731a9834b4804e00186fec9f474274da2eebd9b2891a4eb834bbab6360e9d2d4a9944561f2730104aeb8796305aaaadbde7af77a46056ad

Score

7^/10

upx

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral19/memory/2584-0-0x00000000001F0000-0x000000000028C000-memory.dmp	upx
behavioral19/memory/2624-1-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral19/memory/2624-2-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral19/memory/2800-4-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral19/memory/2468-5-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral19/memory/2468-8-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral19/memory/2648-9-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral19/memory/2648-11-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral19/memory/2636-14-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2584	perl.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2584	2744	cmd.exe	29
PID 2744 wrote to memory of 2584	2744	cmd.exe	29
PID 2744 wrote to memory of 2584	2744	cmd.exe	29
PID 2744 wrote to memory of 2584	2744	cmd.exe	29
PID 2584 wrote to memory of 2624	2584	perl.exe	30
PID 2584 wrote to memory of 2624	2584	perl.exe	30
PID 2584 wrote to memory of 2624	2584	perl.exe	30
PID 2584 wrote to memory of 2624	2584	perl.exe	30
PID 2584 wrote to memory of 2800	2584	perl.exe	31
PID 2584 wrote to memory of 2800	2584	perl.exe	31
PID 2584 wrote to memory of 2800	2584	perl.exe	31
PID 2584 wrote to memory of 2800	2584	perl.exe	31
PID 2584 wrote to memory of 2468	2584	perl.exe	32
PID 2584 wrote to memory of 2468	2584	perl.exe	32
PID 2584 wrote to memory of 2468	2584	perl.exe	32
PID 2584 wrote to memory of 2468	2584	perl.exe	32
PID 2584 wrote to memory of 2648	2584	perl.exe	33
PID 2584 wrote to memory of 2648	2584	perl.exe	33
PID 2584 wrote to memory of 2648	2584	perl.exe	33
PID 2584 wrote to memory of 2648	2584	perl.exe	33
PID 2584 wrote to memory of 2636	2584	perl.exe	34
PID 2584 wrote to memory of 2636	2584	perl.exe	34
PID 2584 wrote to memory of 2636	2584	perl.exe	34
PID 2584 wrote to memory of 2636	2584	perl.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Gccg\Install Pokemon Cards.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\Gccg\perl.exe
  perl gccg_package install core client fonts-windows windows32 pokemon pokemon-cards-*
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://gccg.sourceforge.net/modules/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.derangedmonkey.com/bmin/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.reneploetz.de/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2468
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://lotrtcgdb.com/files/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://whiterose.net/~wlk/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2636

memory/2468-8-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2468-5-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2584-3-0x00000000001F0000-0x000000000028C000-memory.dmp

Filesize
624KB

Download
memory/2584-0-0x00000000001F0000-0x000000000028C000-memory.dmp

Filesize
624KB

Download
memory/2584-10-0x00000000001F0000-0x000000000028C000-memory.dmp

Filesize
624KB

Download
memory/2624-2-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2624-1-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2636-14-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2648-9-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2648-11-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2800-4-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download